{"id":"CVE-2026-105652","aliases":["BIT-ghost-2026-104415","BIT-ghost-2026-105652","EUVD-2026-92762","GHSA-53vv-xm9f-mm82"],"status":"published","title":"Ghost: Password Hash Ordering Disclosure in Ghost Admin API","description":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00258,"percentile":0.17582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203","CWE-943"],"published":"2026-10-02T11:37:58.363Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"npm","package":"ghost","fixed_in":["6.64.0"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ghost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.2"},{"fixed":"6.64.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.2"},{"fixed":"6.64.0"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.2"},{"fixed":"6.64.0"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.2"},{"fixed":"6.64.0"}]}],"bundled":2}],"products":[{"vendor":"tryghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-53vv-xm9f-mm82","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/TryGhost/Ghost/pull/30760","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105652","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-53vv-xm9f-mm82"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104415","tags":["web","advisory"]},{"url":"https://www.vulncheck.com/advisories/ghost-0.7.2-before-6.64.0-password-hash-ordering-disclosure-via-admin-api","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104415.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105652.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-105652","title":"Ghost: Password Hash Ordering Disclosure in Ghost Admin API","description":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-05T19:11:52.597Z","modified":"2026-10-05T19:54:24.255Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-203","CWE-943"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-92762","description":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-05T19:11:52Z","modified":"2026-10-05T19:54:24Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:39.05741Z"}],"ghsa":[{"id":"GHSA-53vv-xm9f-mm82","title":"Ghost: Password Hash Ordering Disclosure in Ghost Admin API","description":"### Impact\n\nAny staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v0.7.2 up to v6.64.0.\n\n### Patches\n\nv6.64.0 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks [carfeii](https://github.com/carfeii) and [Nhat Anh Vu](https://github.com/nhattanhh) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-07T20:27:22Z","modified":"2026-10-07T20:27:22Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-203","CWE-943"],"updated_at":"2026-11-02T14:41:29.107536Z"}],"nvd":[{"id":"CVE-2026-105652","description":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-05T20:17:14.18Z","modified":"2026-10-06T15:03:59.427Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-203","CWE-943"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"CVE-2026-104415","title":"Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API","description":"Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.","status":"published","published":"2026-10-02T11:37:58.363Z","modified":"2026-10-28T02:31:14.098310252Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"CVE-2026-105652","title":"Ghost: Password Hash Ordering Disclosure in Ghost Admin API","description":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-05T19:11:52.597Z","modified":"2026-10-28T02:30:51.514374348Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-203","CWE-943"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-53vv-xm9f-mm82","title":"Ghost: Password Hash Ordering Disclosure in Ghost Admin API","description":"### Impact\n\nAny staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v0.7.2 up to v6.64.0.\n\n### Patches\n\nv6.64.0 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks [carfeii](https://github.com/carfeii) and [Nhat Anh Vu](https://github.com/nhattanhh) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-07T20:27:22Z","modified":"2026-10-13T08:25:43.802827486Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-203","CWE-943"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"BIT-ghost-2026-104415","title":"Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API","description":"Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.","status":"published","published":"2026-10-09T10:45:17.299Z","modified":"2026-10-13T08:25:43.802827486Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"BIT-ghost-2026-105652","title":"Ghost: Password Hash Ordering Disclosure in Ghost Admin API","description":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-13T06:50:23.382Z","modified":"2026-10-13T08:25:43.802827486Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}