CVE-2026-103275

Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

State: Published
Severity: 5.3 Medium
Published: Oct 1, 2026
Updated: Oct 6, 2026
Reserved: Sep 30, 2026

Description

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-203 Observable Discrepancy

Affected Products

Product	Versions
GhostTryGhost	5.42.2 to before 6.58.0Affected 6.58.0Not affected

References

GitHub Security Advisory (GHSA-ghq6-q78f-2cpg)vendor-advisory
https://github.com/TryGhost/Ghost/commit/5ef16abe85e9b71ac3f1b1e2cbc462802efe3b5bpatch
VulnCheck Advisory: Ghost 5.42.2 before 6.58.0 Password Hash Disclosurethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.