CVE-2026-70590: Ghost CMS Information Disclosure Flaw

CVE-2026-70590 Overview

CVE-2026-70590 is an information disclosure vulnerability in Ghost, a Node.js-based content management system. Any authenticated staff-level user could retrieve the hashed passwords of other staff users through the Ghost Admin API. The flaw exists in Ghost versions prior to 6.54.1, where API endpoints did not consistently apply field-level filtering to reject restricted user attributes. An attacker with staff credentials could exfiltrate password hashes and mount offline password-guessing attacks against them. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is fixed in Ghost 6.54.1.

Critical Impact
Authenticated staff users can leak hashed passwords of other staff accounts through the Admin API, enabling offline cracking and potential account takeover if Device Verification is bypassed or absent.

Affected Products

Ghost (Node.js CMS) versions prior to 6.54.1
Ghost Admin API endpoints exposing user records
Self-hosted and managed Ghost deployments running vulnerable releases

Discovery Timeline

2026-08-04 - CVE-2026-70590 published to the National Vulnerability Database
2026-08-05 - CVE-2026-70590 last updated in NVD
Ghost 6.54.1 - TryGhost releases patched version addressing the disclosure

Technical Details for CVE-2026-70590

Vulnerability Analysis

Ghost exposes user and staff records through its Admin API. Before version 6.54.1, several endpoints returned user objects without stripping sensitive fields such as the bcrypt password hash. Any account with staff-level privileges could query these endpoints and receive password hashes belonging to other staff members, including administrators. The disclosed hashes support offline dictionary and brute-force attacks. Device Verification should normally prevent an attacker from logging in with a recovered password from an unrecognized device. Depending on the underlying database collation, retrieved hashes may not preserve correct character casing, which increases the compute cost for successful cracking but does not eliminate the risk.

Root Cause

The root cause is missing enforcement of Admin API restricted field filtering across multiple endpoints. The posts and pages endpoints, along with related user-linked APIs, did not apply the rejectAdminApiRestrictedFieldsTransformer from api-filter-utils when processing NQL filters and includes. Because included user relations were serialized without a field allow-list, the password hash column was returned alongside profile data.

Attack Vector

Exploitation requires an authenticated staff account and network access to the Admin API. The attacker issues a filter or include query against a vulnerable endpoint that resolves associated user records. The response contains the target staff members' password hashes. Once hashes are retrieved, the attacker performs offline cracking. If a plaintext password is recovered and Device Verification is unavailable, misconfigured, or the attacker uses a trusted device, account takeover becomes possible.

javascript

// Patch: ghost/core/core/server/api/endpoints/pages.js
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.paid_conversions', 'post_revisions', 'post_revisions.author'];
 const UNSAFE_ATTRS = ['status', 'authors', 'visibility'];

Source: GitHub Commit 63c31fad

The patch imports rejectAdminApiRestrictedFieldsTransformer into the pages and posts endpoints so restricted user fields, including the password hash column, are removed from API filter processing and response serialization.

Detection Methods for CVE-2026-70590

Indicators of Compromise

Admin API responses to /ghost/api/admin/users, /posts, or /pages that include unusually large include or filter parameters referencing authors or user relations.
Presence of bcrypt-style strings (starting with $2a$, $2b$, or $2y$) in application response logs or reverse-proxy access logs.
Successful staff logins from previously unseen devices shortly after suspicious Admin API activity.

Detection Strategies

Inspect Ghost application logs and web server access logs for Admin API requests that request user includes with unexpected filter chains.
Alert on any HTTP response payloads returned by Ghost that match bcrypt hash regular expressions.
Correlate staff API token or session activity against baseline behavior to flag accounts issuing bulk user or author queries.

Monitoring Recommendations

Enable verbose Admin API request logging and forward logs to a central SIEM for retention and query.
Track the running Ghost version in asset inventory and alert when instances remain below 6.54.1.
Monitor Device Verification events and failed second-factor challenges tied to staff accounts, especially administrators.

How to Mitigate CVE-2026-70590

Immediate Actions Required

Upgrade all Ghost instances to version 6.54.1 or later as published in the GitHub Release v6.54.1.
Rotate passwords for all staff accounts after patching, prioritizing Owner and Administrator roles.
Invalidate existing Admin API keys and staff sessions, then reissue credentials.
Review staff user lists and remove inactive or unnecessary accounts to reduce the pool of potential abusers.

Patch Information

The fix is delivered in Ghost 6.54.1. It applies rejectAdminApiRestrictedFieldsTransformer to additional API endpoints so restricted fields, including password hashes, are excluded from Admin API filters and response payloads. See the GitHub Security Advisory GHSA-jm22-3w23-5q7w and the Pull Request #29628 for the full change set.

Workarounds

If immediate patching is not possible, restrict Admin API network access to trusted IP ranges using a reverse proxy or WAF.
Enforce Device Verification and strong password policies for every staff account to raise the cost of offline cracking.
Reduce staff account counts and audit role assignments so fewer users hold the privileges required to reach the vulnerable endpoints.

bash

# Upgrade a self-hosted Ghost installation via Ghost-CLI
ghost update --v 6.54.1
ghost ls
# Confirm the reported version is 6.54.1 or later