CVE-2026-70594

Received Received - Intake

Ghost Admin Session Fixation Vulnerability in Ghost CMS

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70594

Affected Vendors & Products

Vendor	Product	Version / Range
ghost	ghost	From 2.2.0 (inc) to 6.54.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

This vulnerability is a session fixation issue in Ghost, a Node.js content management system. Between versions 2.2.0 and 6.54.1, Ghost Admin did not invalidate existing sessions when a user logged in. This allowed attackers to fixate a session ID before a user logged in, potentially gaining unauthorized access if another vulnerability existed on the same domain.

Detection Guidance

Detection requires checking Ghost Admin version and session handling. Verify Ghost version is 6.54.1 or later. Inspect session management for improper session persistence during login. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to hijack a user's session, gaining access to sensitive data or administrative functions. Successful exploitation requires another vulnerability on the same domain, making it harder but not impossible to exploit.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected Ghost versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade Ghost to version 6.54.1 or later to address the session fixation issue. Ensure no other vulnerabilities exist on the same domain where Ghost Admin is hosted.

Hi! I’m here to help you understand CVE-2026-70594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70