{"id":"EUVD-2026-52934","enisaUuid":"14724ab4-fcfa-3dc6-90d6-594efa2803a8","description":"Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.","datePublished":"Aug 4, 2026, 9:27:22 PM","dateUpdated":"Aug 5, 2026, 2:28:28 PM","baseScore":4.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w\nhttps://github.com/TryGhost/Ghost/pull/29628\nhttps://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.54.1\n","aliases":"CVE-2026-70590\nGHSA-jm22-3w23-5q7w\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"1c34e9a5-962f-359d-a376-3ebdfbc527f7","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"\u003c 6.54.1"}],"enisaIdVendor":[{"id":"0a6016e6-af20-3e21-bc14-de7039139c03","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"654b5e70-94c1-363d-b398-a8a549989bee","vulnerability":{"id":"CVE-2026-70590","description":"Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.","datePublished":"Aug 4, 2026, 9:27:22 PM","dateUpdated":"Aug 5, 2026, 2:28:28 PM","status":"PUBLISHED","baseScore":4.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w\nhttps://github.com/TryGhost/Ghost/pull/29628\nhttps://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.54.1\n","enisa_id":"EUVD-2026-52934\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 7, 2026, 7:16:50 AM","vulnerabilityProduct":[{"id":"c71cc01d-ec13-3386-86ab-7549a60a416a","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"\u003c 6.54.1"}],"vulnerabilityVendor":[{"id":"b7c0e67b-179f-3b85-bba8-4a2210738a5b","vendor":{"name":"TryGhost"}}]}},{"id":"724f7daa-618f-3512-b2ee-a567abde9a6b","vulnerability":{"id":"GHSA-jm22-3w23-5q7w","description":"Ghost: Blind Password Hash Disclosure in Ghost Admin API","datePublished":"Aug 4, 2026, 9:28:35 PM","dateUpdated":"Aug 4, 2026, 9:28:35 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w\nhttps://github.com/TryGhost/Ghost/pull/29628\nhttps://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.54.1\n","enisa_id":"EUVD-2026-52934\n","aliases":"GHSA-jm22-3w23-5q7w\nCVE-2026-70590\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}