CVE-2026-103275

MEDIUMCVSS 4.3

Description

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.

Timeline

Published:October 1st, 2026 11:17 AM

Last modified:October 6th, 2026 2:17 AM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-203

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/5ef16abe85e9b71ac3f1b1e2cbc462802efe3b5b
https://github.com/TryGhost/Ghost/security/advisories/GHSA-ghq6-q78f-2cpg
https://www.vulncheck.com/advisories/ghost-5.42.2-before-6.58.0-password-hash-disclosure

Source: NIST NVD · Data may lag official sources by up to one minute