Executive brief
Ghost is a popular open-source content management system and publishing platform. A security flaw in the administrative interface allowed staff members to access the encrypted password hashes of other staff users. If an attacker successfully cracks these hashes, they could potentially take over other accounts, although built-in security features like device verification and multi-factor authentication provide significant protection against such attempts.
Technical details
A vulnerability in the Ghost Admin API (CWE-200) allows authenticated staff-level users to disclose the password hashes of other staff users. The root cause is an insufficient restriction on NQL (Native Query Language) filters within certain API endpoints, specifically pages and posts, which failed to properly redact sensitive fields during query processing. An attacker with staff privileges can use crafted filters to leak hashes, though the difficulty of a subsequent offline brute-force attack may be increased by database-specific casing issues. The vulnerability is mitigated by Ghost's 'Device Verification' feature and can be further defended against by enabling MFA. The issue was addressed in version 6.54.1 by applying NQL transformer functions to more APIs to reject restricted fields.
Affected products
- TryGhost Ghost <= 6.54.0
Timeline
- 2026-07-27: patched: Fix merged in PR #29628 and released in v6.54.1
- 2026-07-30: disclosed: Initial advisory publication
- 2026-08-04: advisory: GitHub Advisory published and reviewed
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w
- https://github.com/TryGhost/Ghost/pull/29628
- https://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00
- https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
- https://api.github.com/repos/TryGhost/Ghost/security-advisories/GHSA-jm22-3w23-5q7w