CVE-2026-105652: Ghost CMS Information Disclosure Vulnerability

CVE-2026-105652 Overview

CVE-2026-105652 affects Ghost, a Node.js content management system used to publish websites and newsletters. The flaw lets any authenticated staff-level user determine the relative ordering of other staff users' hashed passwords through the Admin API. The issue exists in versions from 0.7.2 up to 6.64.0 and is fixed in 6.64.0. The vulnerability is tracked as CWE-203: Observable Discrepancy and does not directly disclose password hashes or provide a practical path to password recovery.

Critical Impact
An authenticated staff user can abuse Admin API filter and order parameters to observe the sort order of hashed password values belonging to other staff accounts, enabling limited information inference.

Affected Products

Ghost CMS versions 0.7.2 through 6.63.x
Ghost Admin API endpoints exposing filter and order parameters
Self-hosted and managed Ghost deployments prior to version 6.64.0

Discovery Timeline

2026-10-05 - CVE-2026-105652 published to NVD
2026-10-06 - Last updated in NVD database
Version 6.64.0 - TryGhost releases the fix in the v6.64.0 release

Technical Details for CVE-2026-105652

Vulnerability Analysis

Ghost exposes an Admin API that supports filtering and ordering of resources through query parameters. Prior to version 6.64.0, these parameters were not sufficiently restricted on endpoints that referenced user records. A staff-level user could craft requests that order results by the password column, which stores the bcrypt hash. By observing the resulting record order and iteratively narrowing filters, an attacker infers the lexicographic ranking of hashed passwords belonging to other staff accounts. The hashes themselves are never returned in the response body, so the attack yields only ordering information rather than the hash values. This matches the CWE-203 pattern of an observable discrepancy leaking indirect information.

Root Cause

The Admin API controllers accepted arbitrary filter and order parameters without constraining them to a safe allowlist of fields. Sensitive columns such as password were reachable through these parameters because validation was performed per-model rather than per-endpoint. Authentication was enforced, but authorization did not restrict which attributes a staff role could sort or filter against.

Attack Vector

Exploitation requires valid staff-level credentials and network access to the Ghost Admin API. The attacker issues authenticated requests to Admin API endpoints while supplying crafted order and filter parameters that reference the password field. Response ordering reveals relative hash positions without exposing hash values directly.

javascript

// Security patch in ghost/core/core/server/api/endpoints/actions.js
// Introduces restrictAdminApiQueryOptions to validate filter/order params
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
// Source: https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f

javascript

// Security patch in ghost/core/core/server/api/endpoints/automated-emails.js
   DEFAULT_EMAIL_DESIGN_SETTING_SLUG,
 } = require('../../services/member-welcome-emails/constants');
 const { validateEmailSenderFields } = require('./utils/validate-email-sender-fields');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   automatedEmailNotFound: 'Automated email not found.',
// Source: https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f

Detection Methods for CVE-2026-105652

Indicators of Compromise

Admin API requests containing order=password or variants referencing the password column in query strings.
Repeated authenticated requests from a single staff account iterating through filter parameters that reference user attributes.
Unusual volumes of /ghost/api/admin/users/ or related endpoint queries from non-administrator staff accounts.

Detection Strategies

Inspect Ghost application and reverse-proxy logs for Admin API query strings referencing sensitive columns such as password, secret, or internal identifiers.
Correlate staff user session activity with high-frequency API enumeration patterns that could indicate ordering-based inference.
Review the GHSA-53vv-xm9f-mm82 advisory for the authoritative list of impacted endpoints.

Monitoring Recommendations

Forward Ghost access logs and application logs to a centralized SIEM for query-parameter analysis and retention.
Alert on anomalous Admin API usage patterns from staff-tier accounts, especially burst requests with varying filter values.
Baseline normal Admin API traffic per staff user so deviations in request volume or endpoint diversity surface quickly.

How to Mitigate CVE-2026-105652

Immediate Actions Required

Upgrade Ghost to version 6.64.0 or later as published in the v6.64.0 release notes.
Audit existing staff accounts and remove or downgrade any that are no longer needed, since exploitation requires an authenticated staff role.
Rotate staff passwords after upgrading, particularly if abnormal Admin API activity is identified in historical logs.

Patch Information

The fix is delivered in Ghost 6.64.0 through pull request #30760 and commit 4fb587e. The patch introduces a restrictAdminApiQueryOptions utility that validates and restricts the filter and order parameters accepted by Admin API endpoints, preventing references to sensitive columns such as password.

Workarounds

Restrict Admin API access at the network layer to trusted IP ranges while upgrade planning is in progress.
Enforce strong, unique passwords and multi-factor authentication for all staff accounts to reduce the value of any inferred ordering information.
Temporarily reduce the number of staff-level accounts to the minimum required for operations until the patch is applied.

bash

# Upgrade a self-hosted Ghost installation to the patched release
ghost update --version 6.64.0

# Verify the installed version matches the fixed release
ghost version