Junglewise Threat Intelligence

CVE-2026-70594: TryGhost Ghost session fixation in Ghost Admin

CVE-2026-70594 · Severity: medium · CVSS 6.7 · Published 2026-08-04

Executive brief

Ghost, a popular open-source publishing platform, was found to have a flaw in its administrative interface where user sessions were not properly refreshed upon login. This could allow an attacker to 'fix' a session ID and gain unauthorized access to a staff member's account if they can exploit a separate vulnerability on the same web domain. An exploit could lead to full account takeover, allowing unauthorized parties to modify content or access sensitive administrative data.

Technical details

A session fixation vulnerability (CWE-384) existed in Ghost Admin because the `createSessionForUser` function did not call `req.session.regenerate()` upon successful authentication. This allowed an attacker to pre-set a session identifier that remained valid after the victim logged in. The attack vector is classified as 'Adjacent' with 'High' complexity because it requires the attacker to have a foothold on the same domain (e.g., via another vulnerability or shared hosting environment) to plant the session cookie. The fix, introduced in version 6.54.1, ensures that the Express session is regenerated and verification-related fields are restored to a new session object during the login flow.

Affected products

  • TryGhost Ghost >= 2.2.0, < 6.54.1

Timeline

  • 2026-07-27: patched: Fix merged into main branch via PR #29634
  • 2026-07-30: disclosed: Initial advisory publication by Ghost maintainers
  • 2026-08-04: advisory: GitHub Advisory Database entry published/reviewed

References

Related threats