CVE-2026-70590

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.54.1

Description Staff-level users can leak the hashed passwords of other staff members through the Ghost Admin API. This could allow an attacker to perform an offline password-guessing attack to potentially take over accounts. However, Device Verification is intended to prevent logins using recovered passwords. The difficulty of such an attack may vary depending on the database used, as leaked hashes might not maintain correct character casing.

Recommendations Update to version 6.54.1. Enable Multi-factor Authentication (MFA) for all staff users as a temporary mitigation to prevent unauthorized logins via recovered passwords.