CVE-2026-104415CWE-203

CVE-2026-104415

Low · published October 2, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00205 · 9.9th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-10-02T16:17Z
References (2)
https://github.com/TryGhost/Ghost/security/advisories/GHSA-53vv-xm9f-mm82 · [email protected]https://www.vulncheck.com/advisories/ghost-0.7.2-before-6.64.0-password-hash-ordering-disclosure-via-admin-api · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:37Z
    Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
    cvelistv5