CVE-2026-70594

MEDIUM 6.7

Ghost: Session Fixation in Ghost Admin

CVSS Score

6.7

EPSS Score

0.0%

EPSS Percentile

0th

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

CWE	CWE-384
Vendor	tryghost
Product	ghost
Published	Aug 4, 2026

Stay Ahead of the Next One

Get instant alerts for tryghost ghost

Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

TryGhost / Ghost

>= 2.2.0, < 6.54.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh github.com: https://github.com/TryGhost/Ghost/pull/29634 github.com: https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.54.1