What’s Vulnerable › Vulnerabilities

CVE-2026-103275: Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-06
• Weakness: CWE-203

Description

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.

Affected products

• TryGhost Ghost: from 5.42.2 before 6.58.0 — fixed in 6.58.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.58.0. Check the vendor advisory for mitigations.

References

• https://github.com/TryGhost/Ghost/commit/5ef16abe85e9b71ac3f1b1e2cbc462802efe3b5b
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-ghq6-q78f-2cpg
• https://www.vulncheck.com/advisories/ghost-5.42.2-before-6.58.0-password-hash-disclosure

Get alerted when CVE-2026-103275 or the next vulnerability affects your stack