CVE-2026-104415

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.0

Description An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is achieved by querying the Admin API to infer hash ordering, although the flaw does not directly expose the hashes or facilitate practical password recovery.

Recommendations Update Ghost to version 6.64.0 or later.