CVE-2026-70590: Blind Password Hash Disclosure in TryGhost Ghost Admin API via Insecure Filter Mapping

Vulnerability ID: CVE-2026-70590
CVSS Score: 4.8
Published: 2026-08-04

An authenticated staff-level user can perform a side-channel, boolean-based blind database query attack through the Ghost Admin API to systematically extract the hashed passwords (bcrypt) of other staff users, including administrators, due to insecure filter mapping.

TL;DR

Authenticated staff-level users can exploit insecure nested filter mapping in the Ghost Admin API to extract bcrypt password hashes of other users, including administrators, via boolean-based blind SQL side-channel queries.

Technical Details

• CWE ID: CWE-200
• Attack Vector: Network (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N)
• CVSS Score: 4.8
• EPSS Score: 0.0
• Impact: Information Disclosure (Password Hashes)
• Exploit Status: None (No public weaponized exploit)
• KEV Status: Not Listed

Affected Systems

• Ghost (TryGhost/Ghost) CMS
• Ghost: < 6.54.1 (Fixed in: 6.54.1)

Code Analysis

Commit: 63c31fa

Applied NQL transformer functions to more APIs. (#29628)

@@ -2,6 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');

Mitigation Strategies

• Immediate upgrade to Ghost version 6.54.1 or newer.
• Implement WAF rules to drop or block URI query parameters containing password-related strings on administrative endpoints.

Remediation Steps:

1. Identify all deployed self-hosted Ghost instances.
2. Execute the 'ghost update' command via Ghost-CLI to upgrade instances to version 6.54.1 or above.
3. Deploy temporary WAF filters to inspect and block malicious Admin API query strings targeting critical backend properties.
4. Review Ghost access logs for unexpected iterative queries containing relational parameters.

References

• GitHub Security Advisory GHSA-jm22-3w23-5q7w
• Fix Commit
• Pull Request #29628
• Release Tag v6.54.1
• CVE Registry Record

Read the full report for CVE-2026-70590 on our website for more details including interactive diagrams and full exploit analysis.