CVE-2026-104415 TryGhost CVE debrief

Who should care

Defenders responsible for Ghost deployments, especially those with staff-level users, should assess exposure and prioritize verification and potential updates. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and monitor for potential exploitation attempts.

Why it matters

CVE-2026-104415 allows staff-level users to determine relative ordering of other staff users' hashed passwords in Ghost Admin API. Defenders should verify exposure, prioritize updates or compensating controls, and monitor for potential exploitation attempts.

• Staff-level users can determine relative ordering of other staff users' hashed passwords
• No direct disclosure of password hashes
• No practical path to recovering a password
• Verification of exposure and potential updates required

Technical summary

The vulnerability allows staff-level users to determine the relative ordering of other staff users' hashed passwords in the Ghost Admin API. This does not directly disclose password hashes and does not provide a practical path to recovering a password. The issue is present in Ghost from version 0.7.2 up to version 6.64.0, which contains a fix. The vulnerability was responsibly disclosed by carfeii and Nhat Anh Vu. Defenders should prioritize verifying exposure in Ghost deployments, especially for staff-level users, and assess the need for updates or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in Ghost deployments, especially for staff-level users, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify Ghost version and check if it is within the vulnerable range (from v0.7.2 up to v6.64.0)
• Update Ghost to version 6.64.0 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows staff-level users to determine the relative ordering of other staff users' hashed passwords, but does not directly disclose password hashes or provide a practical path to recovering a password. Affected versions are from v0.7.2 up to v6.64.0, which contains a fix. The vulnerability was responsibly disclosed by carfeii and Nhat Anh Vu. Defenders should prioritize verifying exposure in Ghost deployments, especially for staff-level users, and assess the need for updates or compensating controls. Evidence is based

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.