PT-2026-109654

Name of the Vulnerable Software and Affected Versions Strapi versions 5.47.0 through 5.57.0 Description An improper authorization issue exists where admin API tokens maintain full access to Content Manager fields even after the owner's role has been restricted. This occurs because the...

BIT-GHOST-2026-104416 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

BIT-GHOST-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

BIT-GHOST-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

BIT-GHOST-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

PT-2026-109159

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

PT-2026-109158

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 0.7.2, 6.64.0...

GHSA-53VV-XM9F-MM82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

GHSA-V6Q3-XQXM-6F5V Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

NPM: Ghost: Invite Token Disclosure in Ghost Admin API

NPM: Ghost: Invite Token Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 4.39.0, 6.64.0...

CVE-2026-105675

The Ghost Node.js content management system is affected by a vulnerability where staff users with permissions to view staff invites can discover secret tokens for pending invites. This flaw exists in versions 4.39.0 through 6.64.0 . An attacker could exploit this to escalate privileges by accepti...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...