Ghost CMS CVE-2026-105652

Requires an authenticated staff-level account on the Ghost instance (PR:L) with access to the admin API. The attacker must be able to supply query/ordering options to admin API endpoints (the patched restrictAdminApiQueryOptions path), which is why the flaw affects deployments where staff users exist and can reach the admin API. Exploitation is LIMITED by the need for a trusted staff account, high attack complexity (AC:H) in deriving anything meaningful, and the fact that only relative ordering - not the hashes or passwords - is exposed. Affects versions from 0.7.2 up to but not including 6.64.0.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The CVSS 3.1 base score of 3.1 (LOW) with vector AV:N/AC:H/PR:L/UI:N reflects that exploitation requires an already-authenticated staff-level account (PR:L), high attack complexity (AC:H), and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The CWE-203 classification (observable discrepancy / side-channel) matches the description: a staff user can infer the *relative ordering* of other staff users' hashed passwords via admin API query/ordering options, but this does not disclose the hashes themselves and offers no practical path to password recovery. No EPSS score, CISA KEV listing, SSVC decision, or POC was provided in the input; absence of these is consistent with a low-value, hard-to-weaponize bug rather than indicating a hidden priority. The confidentiality impact is marginal and the precondition (trusted staff account) significantly narrows the threat population to insiders, so this is a high-CVSS-confidence-but-low-real-risk finding that should be patched in routine maintenance, not as an emergency.

A malicious or curious staff-level user in a Ghost instance crafts admin API requests that sort or filter the user collection by the internal password field, allowing them to observe the relative ordering of other staff members' hashed passwords. No public exploit code was identified, and because the leak is only ordering metadata with high complexity to abuse, the attacker gains at most a weak side-channel that does not expose or recover any actual password.