Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
CVE-2026-104415
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104415
Ghost
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TryGhost",
"product": "Ghost",
"versions": [
{
"status": "affected",
"version": "0.7.2",
"lessThan": "6.64.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.64.0",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/ghost",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104415
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #8005 · Revision 1
- Added to Heist Feed
- Publisher date