Information Disclosure Vulnerability in Ghost Admin API by Ghost

CVE-2026-104415

What is CVE-2026-104415?

Ghost versions prior to 6.64.0 are susceptible to an information disclosure vulnerability within the Admin API. This issue allows authenticated staff-level users to infer the ordering of password hashes belonging to other staff members. While the vulnerability does not directly expose the hashes or simplify their recovery, it poses a potential risk as it could aid in unauthorized access or attacks on account integrity through educated guesses based on hash comparisons. Proper user access controls and API security measures should be implemented to mitigate this risk.

References