Ghost Admin CVE-2026-70594

Exploitation requires two conditions to be satisfied simultaneously. First, the attacker must have the ability to set a cookie or otherwise inject a controlled session identifier into the victim's browser on the same domain as Ghost Admin - this requires a separate, independently exploitable vulnerability such as a reflected/stored XSS flaw, a subdomain takeover, or a cookie-scoping weakness on the same eTLD+1. Second, the victim must actively authenticate to Ghost Admin (UI:R) after the session identifier has been planted. Ghost Admin versions 2.2.0 through 6.54.0 are required (the vulnerability is absent in prior versions and patched in 6.54.1). Exploitation is blocked if Ghost Admin is hosted on a fully isolated domain with no user-controllable content, or if no secondary same-domain vulnerability exists for the attacker to exploit.

The CVSS 3.1 score of 6.7 with vector AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L appropriately reflects the chained nature of this attack. The Adjacent Vector (AV:A) and High Complexity (AC:H) are the key limiting factors: exploitation requires the attacker to first leverage a separate vulnerability on the same domain as Ghost Admin - such as an XSS flaw or subdomain cookie injection - to plant a controlled session identifier in the victim's browser. The victim must then actively log into Ghost Admin (UI:R). Despite the high C and I impact scores reflecting full admin-level access, the real-world risk is substantially lower than a standalone critical flaw because the attack chain demands a prerequisite compromise. No EPSS data was provided, and neither KEV status nor public exploit code was identified, further reducing urgency. This is a defense-in-depth gap rather than an immediately weaponizable critical vulnerability. However, sites that host Ghost Admin on a domain shared with user-controllable content (e.g., user-generated subdomains, embedded comment systems with XSS) face meaningfully elevated risk.

An attacker identifies a cross-site scripting vulnerability or subdomain cookie-injection vector on the same domain as Ghost Admin. The attacker uses this secondary flaw to set a known session cookie in the victim's browser. When the Ghost Admin editor or contributor subsequently logs in, Ghost accepts the pre-existing session ID and marks it as authenticated rather than issuing a new one. The attacker then uses the planted session ID to access Ghost Admin with full editor or administrator privileges, enabling content manipulation, user management changes, or credential theft.