Ghost CMS EUVD-2026-91426

Requires an authenticated account with staff-level privileges on the target Ghost instance (PR:L) with access to the Admin API - this is an insider/compromised-account scenario, not remote-unauthenticated. Exploitation is further limited by high attack complexity (AC:H) and an attack prerequisite (AT:P in the 4.0 vector), meaning the attacker must perform repeated, carefully-crafted Admin API queries and analyze response discrepancies. Even when successful, the outcome is bounded: it only discloses the relative ordering of other staff users' password hashes and, per the description, does not directly reveal the hashes or enable practical password recovery.

This is a low-severity, low-priority issue, and the available signals are consistent in pointing that way. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores only 2.3: although the Admin API is network-reachable, exploitation requires an existing authenticated staff account (PR:L), high attack complexity (AC:H), and a present attack prerequisite (AT:P), and the only impact is a low confidentiality leak (VC:L) with no integrity or availability effect. The leak itself - the relative ordering of other staff users' password hashes - is explicitly described as not revealing the hashes and not enabling practical password recovery (consistent with CWE-203, observable discrepancy / side channel). No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No signals conflict here; the only caveat is the absence of EPSS/exploit-maturity data, but given the trivial impact and insider-only prerequisite this does not change the low-priority conclusion. Patch available: upgrading to Ghost 6.64.0 or later is a routine, non-urgent remediation.

A malicious or compromised staff-level user, already authenticated to a Ghost instance, repeatedly queries the Admin API and uses response differences to infer the relative ordering of other staff users' stored password hashes. Because the attack has high complexity and only yields hash ordering - not the hashes themselves - it provides minimal practical value and does not enable password cracking. No public proof-of-concept was referenced.