CVE-2026-103275— Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
Quick assessment
Affected
TryGhost Ghost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghost 5.42.2 至 6.58.0 之前的版本存在一个信息泄露漏洞，该漏洞位于 Admin API 的批量文章和页面编辑及删除端点中。由于对 CVE-2026-70590 的修复不完整，这些端点接受对受限字段（如 ）进行过滤。拥有 Staff 权限的攻击者可以通过观察哪些过滤器匹配成功，推断出其他 Staff 用户的密码哈希值，并针对这些用户发起离线密码猜测攻击。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103275
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过差异性导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103275
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103275
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-103275 (1)
Vendor Advisories for CVE-2026-103275 (2)
-
-
🔗 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure | Advisories | VulnCheck third-party-advisory
Same Patch Batch · TryGhost · 2026-10-01 · 26 CVEs total
| CVE-2026-103268 | 8.8 HIGH | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset |
| CVE-2026-103283 | 8.1 HIGH | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling |
| CVE-2026-103277 | 8.1 HIGH | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed |
| CVE-2026-103292 | 8.0 HIGH | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head |
| CVE-2026-103271 | 7.5 HIGH | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass |
| CVE-2026-103272 | 7.5 HIGH | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API |
| CVE-2026-103286 | 7.3 HIGH | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications |
| CVE-2026-103278 | 7.3 HIGH | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe |
| CVE-2026-103266 | 7.1 HIGH | Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification |
| CVE-2026-103279 | 6.8 MEDIUM | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass |
| CVE-2026-103288 | 6.5 MEDIUM | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like |
| CVE-2026-103289 | 6.5 MEDIUM | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments |
| CVE-2026-103291 | 6.4 MEDIUM | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch |
| CVE-2026-103281 | 5.4 MEDIUM | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API |
| CVE-2026-103274 | 5.3 MEDIUM | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read |
| CVE-2026-103280 | 5.3 MEDIUM | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint |
| CVE-2026-103269 | 5.3 MEDIUM | Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts |
| CVE-2026-103276 | 5.3 MEDIUM | Ghost before 6.20.0 File Read via URL Encoding Bypass |
| CVE-2026-103284 | 4.3 MEDIUM | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback |
| CVE-2026-103282 | 4.3 MEDIUM | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Ghost
-
CVE-2026-103291
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch -
CVE-2026-103292
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_hea -
CVE-2026-103290
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize -
CVE-2026-103289
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments -
CVE-2026-103288
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment L
Same vendor: TryGhost
-
CVE-2026-103291
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch -
CVE-2026-103292
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_hea -
CVE-2026-103290
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize -
CVE-2026-103289
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments -
CVE-2026-103288
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment L
Same weakness: CWE-203
-
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-103272
Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API -
CVE-2026-84461
Zammad: Missing rate limiting allows password brute-forcing -
CVE-2026-91714
Google Chrome 侧信道信息泄露漏洞 -
CVE-2026-91725
Google Chrome 侧信道信息泄露漏洞
V. Comments for CVE-2026-103275
No comments yet