Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103275Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Medium 4.3

In plain English

A medium-severity security flaw in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.

Affected products (as reported)

Vendor	Product	Versions
TryGhost	Ghost	5.42.2 – before 6.58.0

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-ghq6-q78f-2cpg) vendor-advisory
https://github.com/TryGhost/Ghost/commit/5ef16abe85e9b71ac3f1b1e2cbc462802efe3b5b patch
VulnCheck Advisory: Ghost 5.42.2 before 6.58.0 Password Hash Disclosure third-party-advisory