CVE-2026-105652 - Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Back Back to CVE browser

LOW

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Published Oct 5, 2026

3.1

LOW

CVSS 3.1

EPSS 0.26%

Description

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.

Affected products

Vendor TryGhost Product Ghost Default
unknown
Affected
- ≥ 0.7.2, < 6.64.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
TryGhost	Ghost	unknown	Affected ≥ 0.7.2, < 6.64.0

Ecosystem	Package	Introduced	Fixed
npm	ghost	0.7.2	6.64.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-203

CWE-943

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92762
Advisory
https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f
x_refsource_MISC
https://github.com/TryGhost/Ghost/pull/30760
x_refsource_MISC
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
x_refsource_MISC
https://github.com/TryGhost/Ghost/security/advisories/GHSA-53vv-xm9f-mm82
x_refsource_CONFIRM
https://github.com/advisories/GHSA-53vv-xm9f-mm82
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-105652

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92762		Advisory
https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f		x_refsource_MISC
https://github.com/TryGhost/Ghost/pull/30760		x_refsource_MISC
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0		x_refsource_MISC
https://github.com/TryGhost/Ghost/security/advisories/GHSA-53vv-xm9f-mm82		x_refsource_CONFIRM
https://github.com/advisories/GHSA-53vv-xm9f-mm82		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-105652

Change history (2)

Oct 7, 2026, 22:28 UTC EUVD
- Updated
  changed from Oct 5, 2026 to Oct 7, 2026
- Published
  changed from Oct 5, 2026 to Oct 7, 2026

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Oct 5, 2026

Updated Oct 5, 2026

Reserved Oct 5, 2026

Link CVE-2026-105652

CISA Vulnrichment

Updated Oct 5, 2026

NVD

Status Deferred

Modified Oct 6, 2026

Link CVE-2026-105652

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Oct 7, 2026

Updated Oct 7, 2026

Link EUVD-2026-92762

GitHub

Link GHSA-53VV-XM9F-MM82