Listen to this Post
How CVE-2026-70590 Works
This vulnerability resides in the Ghost Admin API’s `browse` and `export` endpoints for pages and posts, affecting versions up to v6.54.0. The core issue is improper restriction of field paths when parsing NQL (Native Query Language) filter parameters.
When a staff-level user makes a request to endpoints like `/ghost/api/admin/pages/` or `/ghost/api/admin/posts/` with a `filter` query parameter, the application passes the raw `frame.options` object directly to the underlying model methods (models.Post.findPage, postsService.browsePosts, postsService.export) without any sanitization.
Specifically, the `browse` controller in `pages.js` and `posts.js` does not inject a `mongoTransformer` to restrict access to sensitive fields. The NQL parser treats compound keys like `authors.password` as regular queryable fields. An attacker can then construct a `filter` query such as `authors.password:{$eq:”
By iterating through possible password hash values, a staff-level user can exfiltrate the bcrypt hashed passwords of other staff members. While Device Verification (email-based 2FA) would normally prevent login with a recovered password, this mechanism can be bypassed if the attacker also compromises the user’s email or if the target does not have MFA enabled. Additionally, if MySQL is used as the database, the case sensitivity of the hashes is lost, making brute-force attacks more difficult but not impossible.
The fix, implemented in v6.54.1 via PR 29628 (commit 63c31fad), introduces a `rejectAdminApiRestrictedFieldsTransformer` that rejects any filter statements containing the `password` segment in their key chain, effectively blocking the blind query path.
DailyCVE Form:
Platform: Ghost (Node.js)
Version: ≤ v6.54.0
Vulnerability: Blind Password Hash Disclosure
Severity: Moderate (CVSS 5.3)
Date: 2026-08-05
Prediction: Patch expected 2026-07-30 (v6.54.1 released)
What Undercode Say: Analytics
The following commands and code snippets demonstrate the vulnerable behavior and the patch applied:
Vulnerable Code Path (Pre-Patch):
// ghost/core/core/server/api/endpoints/pages.js
// The browse controller directly passes frame.options to models.Post.findPage
query(frame) {
return models.Post.findPage(frame.options); // No mongoTransformer applied
}
Vulnerable Code Path (Pre-Patch) – Posts Export:
// ghost/core/core/server/api/endpoints/posts.js
// The export controller passes frame.options to postsService.export
export(frame) {
return postsService.export(frame.options); // No mongoTransformer applied
}
Exploit Filter Query (Blind Injection):
Attempt to extract password hash for a specific staff user curl -X GET "https://target-ghost.com/ghost/api/admin/posts/?filter=authors.password:%7B%22%24eq%22:%22%242a%2410%24...%22%7D" \ -H "Authorization: Bearer <staff_api_key>" A 200 OK with results indicates the hash matches; an empty response indicates it does not.
Patch Implementation (v6.54.1):
// ghost/core/core/server/api/endpoints/utils/api-filter-utils.ts
// The fix injects rejectAdminApiRestrictedFieldsTransformer as mongoTransformer
const mongoTransformer = rejectAdminApiRestrictedFieldsTransformer;
return models.Post.findPage({ ...frame.options, mongoTransformer });
Patch Commit Reference:
git show 63c31fad7e473caa62d8fbb4651a04a2a62b5d00 This commit adds the mongoTransformer to all three vulnerable endpoints.
Exploit
To exploit this vulnerability, an attacker must have valid staff-level credentials for the Ghost Admin API. The attacker then crafts a series of `filter` queries targeting the `authors.password` field, using boolean-based blind injection to test password hash values. By observing the HTTP response (whether results are returned or not), the attacker can gradually reconstruct the bcrypt hash of any staff user. Once the hash is obtained, an offline brute-force attack can be performed to recover the plaintext password.
Protection
- Immediate Upgrade: Update Ghost to version v6.54.1 or later. This is the only complete fix.
- For Docker Users: Pull the latest official Ghost Docker image and restart containers.
- For Ghost-CLI Users: Run `ghost update` to upgrade to the latest version.
- Workaround (If Upgrade Is Not Possible): Enforce Multi-factor Authentication (MFA) for all staff users. This prevents login even if passwords are recovered from the leaked hashes.
- Network Segmentation: Restrict access to the Admin API to trusted IP ranges only, reducing the attack surface.
Impact
- Confidentiality Breach: Any staff-level user can leak the bcrypt hashed passwords of other staff members.
- Account Takeover Risk: Successful offline password cracking can lead to full account compromise.
- Mitigating Factors: Device Verification (email 2FA) adds a layer of protection, but it is not foolproof. MySQL databases lose hash case sensitivity, increasing cracking difficulty.
- Widespread Exposure: Affects all Ghost versions up to v6.54.0, including numerous self-hosted instances.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
