Ghost CMS EUVD-2026-90668

Requires an authenticated Ghost staff-level account (PR:L) with access to the Admin API bulk post and page edit/delete endpoints. The attacker supplies filters referencing restricted fields such as authors.password; the vulnerable versions (5.42.2 up to but not including 6.58.0) fail to reject these filters on the bulk operation code paths (an incomplete fix for CVE-2026-70590). What limits exploitation: it only yields indirect hash inference requiring subsequent offline password cracking (not immediate credential recovery), it needs a pre-existing trusted staff account, and it is fully remediated in 6.58.0 which returns HTTP 400 for restricted-field filters.

This is a genuine but modest-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) correctly frames it as a network-reachable, low-complexity flaw requiring authentication (PR:L = a staff-level account) with low confidentiality impact and no integrity or availability impact. CWE-203 (observable discrepancy) is accurate: the bug is a side-channel/inference oracle, not direct data exposure - an attacker learns password-hash content indirectly from which bulk-filter queries match, then must still run offline brute-force/dictionary attacks to recover plaintext passwords. Exploitation status: no public exploit identified at time of analysis (no POC, no EPSS score, not in CISA KEV). The patch is confirmed available (vendor advisory GHSA-ghq6-q78f-2cpg and commit 5ef16abe). The 5.3 score is appropriate - real but gated behind an existing trusted (staff) account, and the payoff is probabilistic hash inference rather than immediate compromise. Notably this is an INCOMPLETE FIX for CVE-2026-70590, meaning the original remediation missed the Admin API bulk edit/delete code paths; that recurrence slightly raises attention but the practical risk remains low-to-medium.

A malicious or compromised staff user (e.g. an Editor/Author account) calls the Ghost Admin API bulk post or page edit/delete endpoints supplying filters on the restricted field authors.password (e.g. prefix-style match expressions). By observing which filtered bulk operations match records, they infer another staff user's stored password-hash content character by character, then conduct an offline guessing attack against the recovered hash. No public exploit code is known, and the attack requires an authenticated staff account.