CVE-2026-104415
LOW
NVD
CVSS Score
3.1
Severity
LOW
Published
Oct 02, 2026
Vendor
unknown
Description
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.