CVE-2026-70594: Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for…

PriorityP430medium6.7CVSS 3.1

AVAACHPRNUIRSUCHIHAL

EPSS

0.24%

14.2th percentile

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ghost	ghost	>= 2.2.0 < 6.54.1	6.54.1
tryghost	ghost	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.