CVE-2026-104415
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
| CWE | CWE-203 |
| Vendor | tryghost |
| Product | ghost |
| Published | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for tryghost ghost
Be the first to know when new low vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
TryGhost / Ghost
0.7.2 < 6.64.0
References
Credits
🔍 carfeii 🔍 nhattanhh