CVE-2026-105652

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.

• CWE-203
• CWE-943

• https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f
• https://github.com/TryGhost/Ghost/pull/30760
• https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-53vv-xm9f-mm82

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105647Ghost is a Node.js content management system. From 6.54.1 un…4
• CVE-2026-105648Ghost is a Node.js content management system. From 6.0.9 unt…4
• CVE-2026-105649Ghost is a Node.js content management system. From 4.22.0 un…7.3
• CVE-2026-10565A security flaw has been discovered in Open5GS up to 2.7.6. …3.1
• CVE-2026-105650Ghost is a Node.js content management system. From 2.1.0 unt…8.1
• CVE-2026-105651Ghost is a Node.js content management system. From 5.94.0 un…7.3
• CVE-2026-10566A weakness has been identified in FoundationAgents MetaGPT u…5.3
• CVE-2026-10567A security vulnerability has been detected in 1Panel-dev Cor…3.5
• CVE-2026-105675Ghost is a Node.js content management system. From 4.39.0 un…7.5
• CVE-2026-105676Ghost is a Node.js content management system. From 1.20.0 un…4.9
• CVE-2026-105677Ghost is a Node.js content management system. From 6.10.3 un…7.2
• CVE-2026-105678Ghost is a Node.js content management system. From 0.5.0 unt…4.3