CVE-2026-104415 — Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff …
Published: 2026-10-02 · CVSS: 2.3 · CVSS 4.0
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7