CVE-2026-70590: 
JavaScript vulnerability analysis and mitigation

CVE-2026-70590 is a blind password hash disclosure vulnerability in the Ghost Admin API, titled "Ghost: Blind Password Hash Disclosure in Ghost Admin API." It affects all versions of the Ghost Node.js CMS prior to 6.54.1 (npm package ghost). Any staff-level authenticated user could exploit the Ghost Admin API to leak the hashed passwords of other staff users, potentially enabling offline password-guessing attacks and account takeover. The vulnerability was published on July 30, 2026, and assigned a CVSS v3.1 base score of 4.8 (Moderate) (Github Advisory, Ghost Security Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Ghost Admin API failed to apply NQL (Node Query Language) transformer functions consistently across all API endpoints — specifically the pages, posts, and post export endpoints — allowing staff-level users to craft API filter queries that included restricted fields such as password hashes in the query options. The fix (PR #29628, commit 63c31fa) applied a rejectAdminApiRestrictedFieldsTransformer (a mongoTransformer) to the findPage and browsePosts calls in the pages and posts endpoints, as well as to the posts export pipeline, blocking restricted fields from being used in Mongo query options (Ghost Security Advisory, GitHub PR #29628). Exploitation requires an authenticated staff-level account and user interaction, and the attack complexity is rated High due to the specific conditions required (Github Advisory).

A successful exploit allows a malicious staff-level user to retrieve the hashed passwords of other staff accounts via the Ghost Admin API. These hashes can then be subjected to offline brute-force or dictionary attacks, potentially leading to account takeover of other staff users, including administrators. The confidentiality impact is limited (hashes, not plaintext passwords), but the integrity impact is rated High due to the potential for full account compromise. Depending on the database backend, leaked hashes may have incorrect character casing, which increases the difficulty of cracking. Ghost's Device Verification feature provides an additional barrier against login with a recovered password, partially mitigating the risk of full account takeover (Github Advisory, Ghost Security Advisory).

1. Gain Staff Access: Obtain a staff-level account on the target Ghost instance (e.g., through credential theft, phishing, or a compromised invitation link).
2. Authenticate to Ghost Admin API: Use the staff credentials to authenticate and obtain a valid session token or API key for the Ghost Admin API.
3. Craft a Restricted Field Filter Query: Send a crafted API request to a vulnerable endpoint (e.g., /ghost/api/admin/posts/ or /ghost/api/admin/pages/) using a filter parameter that references a restricted field such as password, leveraging the lack of NQL transformer enforcement to include the hash in query results.
4. Extract Password Hashes: Parse the API response to retrieve the hashed passwords of other staff users exposed through the filter bypass.
5. Offline Password Cracking: Use tools such as Hashcat or John the Ripper to perform offline dictionary or brute-force attacks against the recovered hashes.
6. Account Takeover Attempt: If a password is successfully recovered, attempt to log in as the target staff user, noting that Ghost's Device Verification may require additional steps to bypass (Ghost Security Advisory, GitHub PR #29628).

• Logs: Ghost Admin API access logs showing authenticated staff-level requests to /ghost/api/admin/posts/, /ghost/api/admin/pages/, or post export endpoints with unusual filter parameters referencing internal fields such as password or other restricted attributes.
• Network: Repeated or scripted API calls from a single staff account to browse/export endpoints with atypical query parameters, particularly outside normal usage hours.
• Behavioral: A staff account making bulk or automated API requests to user-listing or content-browsing endpoints shortly after login, which may indicate automated hash extraction attempts.

Upgrade Ghost to version 6.54.1 or later, which contains the fix for this vulnerability (Ghost Security Advisory, Ghost v6.54.1 Release). For Docker-based deployments, update to the latest official Ghost Docker image. For Ghost-CLI installations, follow the standard update documentation. If immediate upgrading is not possible, ensure all staff users have Multi-factor Authentication (MFA) / Device Verification enabled to prevent login with any passwords recovered from leaked hashes (Github Advisory).

The vulnerability was responsibly disclosed by Chapman Schleiss and acknowledged by the Ghost security team (Ghost Security Advisory). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.