{"vulnerability": "cve-2026-70590", "sightings": [{"uuid": "8b1cc76d-64cb-491b-b0dd-4a8805e246ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70590", "type": "seen", "source": "https://gist.github.com/alon710/0b530d759c455a262a40add3fda52d22", "content": "# CVE-2026-70590: CVE-2026-70590: Blind Password Hash Disclosure in TryGhost Ghost Admin API via Insecure Filter Mapping\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70590\n\n## Summary\nAn authenticated staff-level user can perform a side-channel, boolean-based blind database query attack through the Ghost Admin API to systematically extract the hashed passwords (bcrypt) of other staff users, including administrators, due to insecure filter mapping.\n\n## TL;DR\nAuthenticated staff-level users can exploit insecure nested filter mapping in the Ghost Admin API to extract bcrypt password hashes of other users, including administrators, via boolean-based blind SQL side-channel queries.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.0\n- **Impact**: Information Disclosure (Password Hashes)\n- **Exploit Status**: None (No public weaponized exploit)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost (TryGhost/Ghost) CMS\n- **Ghost**: < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Immediate upgrade to Ghost version 6.54.1 or newer.\n- Implement WAF rules to drop or block URI query parameters containing password-related strings on administrative endpoints.\n\n**Remediation Steps:**\n1. Identify all deployed self-hosted Ghost instances.\n2. Execute the 'ghost update' command via Ghost-CLI to upgrade instances to version 6.54.1 or above.\n3. Deploy temporary WAF filters to inspect and block malicious Admin API query strings targeting critical backend properties.\n4. Review Ghost access logs for unexpected iterative queries containing relational parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-jm22-3w23-5q7w](https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w)\n- [Fix Commit](https://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00)\n- [Pull Request #29628](https://github.com/TryGhost/Ghost/pull/29628)\n- [Release Tag v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [CVE Registry Record](https://www.cve.org/CVERecord?id=CVE-2026-70590)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70590) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T05:32:02.107633Z"}]}