Riskcovery

CVE-2026-105652

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

State
Published
Severity
3.1 Low
Published
Oct 5, 2026
Updated
Oct 5, 2026
Reserved
Oct 5, 2026

Read the record on cve.org

Description

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.

Scores

CVSSScoreVectorSource
3.13.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-203 Observable Discrepancy
  • CWE-943 Improper Neutralization of Special Elements in Data Query Logic

Affected Products

ProductVersions
GhostTryGhost
  • >= 0.7.2, < 6.64.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.