CVE-2026-104415: Ghost Admin API Information Disclosure

CVE-2026-104415 Overview

CVE-2026-104415 is an information disclosure vulnerability in Ghost, the open-source publishing platform. The flaw affects Ghost versions from 0.7.2 up to but not including 6.64.0. Authenticated staff users can abuse the Admin API to infer the relative ordering of other staff users' password hashes. The issue is categorized under CWE-203: Observable Discrepancy. The vulnerability does not directly expose password hashes and does not enable practical password recovery on its own.

Critical Impact
Authenticated staff-level users can observe side-channel information about other users' password hashes via the Admin API, enabling limited inference without disclosing the hashes themselves.

Affected Products

Ghost versions 0.7.2 through 6.63.x
Ghost self-hosted deployments exposing the Admin API
Ghost(Pro) instances prior to the fixed release

Discovery Timeline

2026-10-02 - CVE CVE-2026-104415 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104415

Vulnerability Analysis

The vulnerability resides in Ghost's Admin API, which exposes administrative functionality to authenticated staff users. A query path in the API returns responses whose structure or ordering depends on the lexicographic position of user password hashes. By issuing crafted queries, a staff user can infer the relative ordering of other users' hashes without reading the hash values directly.

This is an observable-discrepancy weakness. The information leaked is low-value on its own, but it provides an oracle that could support further offline analysis if combined with other leaked data. The vulnerability requires authenticated access with staff privileges, which limits exposure to internal users of a Ghost instance.

For a full technical write-up, review the GitHub Security Advisory GHSA-53vv-xm9f-mm82 and the VulnCheck Advisory on Ghost Password Hash Issue.

Root Cause

The root cause is an Admin API query that permits sorting or filtering based on fields derived from the password column. Because the API does not restrict which columns staff users can order or filter against, the response ordering reveals information about the underlying hash values. The hashes themselves remain protected, but their relative order constitutes side-channel information.

Attack Vector

An authenticated staff user sends targeted queries to the Admin API endpoint responsible for listing user records. By varying sort parameters or filter predicates, the attacker observes how result ordering changes and infers the lexicographic ordering of password hash fields. No elevated privileges, user interaction, or network-adjacent access are required beyond standard staff authentication. The attack has high complexity because exploitation yields only ordering information rather than hash values.

No verified public proof-of-concept code is available. Refer to the vendor advisory for exploitation details.

Detection Methods for CVE-2026-104415

Indicators of Compromise

Repeated Admin API requests from a single staff account targeting user-listing endpoints with varied order or filter parameters.
Unusual query patterns referencing the password field or related columns in Admin API logs.
Elevated query volume from staff accounts that do not normally interact with user-management endpoints.

Detection Strategies

Enable verbose Admin API logging and alert on requests that include ordering or filtering parameters referencing authentication fields.
Baseline normal staff-user Admin API usage and flag deviations in request frequency or parameter diversity.
Correlate Admin API access with staff account role changes to identify reconnaissance from recently added accounts.

Monitoring Recommendations

Forward Ghost application logs to a centralized log platform and retain Admin API access records for forensic review.
Monitor authentication events for Admin API tokens and rotate tokens on anomalous activity.
Track Ghost version inventory across environments to confirm all instances run 6.64.0 or later.

How to Mitigate CVE-2026-104415

Immediate Actions Required

Upgrade all Ghost instances to version 6.64.0 or later.
Audit the staff user list and remove accounts that are inactive or no longer required.
Rotate Admin API keys for any staff account showing anomalous query patterns.
Review Admin API access logs for the query patterns described above.

Patch Information

The vendor fixed this issue in Ghost 6.64.0. The patch restricts which fields staff users can order or filter against through the Admin API, preventing the side-channel inference of password hash ordering. See the GitHub Security Advisory GHSA-53vv-xm9f-mm82 for the fix commit and release notes.

Workarounds

Restrict Admin API exposure to trusted networks using a reverse proxy or firewall rules.
Limit staff role assignments to the minimum set of trusted users until the upgrade is applied.
Enforce multi-factor authentication on staff accounts to reduce the risk of account compromise feeding the oracle.

bash

# Verify installed Ghost version and upgrade using Ghost-CLI
ghost version
ghost update
ghost version