Ghost CMS CVE-2026-70590

Exploitation requires the attacker to hold a valid staff-level user account on the target Ghost installation (PR:H per CVSS). The Ghost Admin API must be network-accessible to the attacker. The vulnerable behavior is in the default browse endpoints for posts and pages - no special non-default configuration is required beyond having multiple staff users present, meaning any standard Ghost installation in the affected version range is susceptible to hash disclosure. Full account takeover faces two compounding barriers: (1) the leaked hash may have incorrect character casing depending on the database backend, increasing offline cracking difficulty, and (2) Device Verification should block a login from an unrecognized device even if a password is successfully recovered, unless the attacker also bypasses or has a recognized device session. Exploitation of hash disclosure is limited to users with staff-level or higher access - unauthenticated or subscriber-level users cannot trigger it.

The vendor-provided CVSS score of 4.8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N) warrants scrutiny on several metrics. The AC:H and UI:R ratings appear inconsistent with the description: querying the Admin API with a crafted filter requires no elevated technical complexity beyond possessing a staff account, and no interaction from a victim staff user is required for the hash disclosure step. The C:L rating may understate impact since the leaked data consists of authentication credentials (password hashes), not merely metadata. The I:H rating accounts for downstream account takeover potential, but that outcome requires a successful offline cracking step plus circumventing Device Verification - making it non-trivial. No EPSS data was supplied in the intelligence feed, and KEV status is absent, confirming no public exploit or active exploitation identified at time of analysis. In practice, this is a meaningful insider-threat or compromised-staff-account risk for Ghost installations with multiple staff users, moderated significantly by Device Verification (which blocks new-device logins even with a valid password) and MFA availability. The primary risk is unauthorized credential material exposure enabling offline attacks, not immediate remote code execution.

A Ghost staff member with a valid account queries the Admin API's posts or pages browse endpoint with a crafted MongoDB filter condition that references the password field of associated author records. The API returns password hash values for other staff accounts in the response. The attacker exports the hashes and runs an offline dictionary or brute-force attack; successful cracking yields a plaintext password, but Device Verification would still challenge a login from an unrecognized device, requiring the attacker to also possess or compromise a trusted device session to complete account takeover. No public exploit code has been identified at time of analysis.