Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M

CVE-2026-70594Ghost: Session Fixation in Ghost Admin

Medium 6.7

In plain English

A medium-severity session fixation in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	ghost	6.54.1	GHSA-7mpp-r37j-x5wh

Affected products (as reported)

Vendor	Product	Versions
TryGhost	Ghost	>= 2.2.0, < 6.54.1

Weakness: CWE-384 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh x_refsource_CONFIRM
https://github.com/TryGhost/Ghost/pull/29634 x_refsource_MISC
https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c x_refsource_MISC
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1 x_refsource_MISC