CVE-2026-70594

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70594
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70594.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70594
Aliases
Published
2026-08-04T21:53:45Z
Modified
2026-09-10T03:31:00Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Ghost: Session Fixation in Ghost Admin
Details

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-384"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70594.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
1ec3dfbfab9f916fd8003c72a14eb3bce6aa48ee
Fixed
6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c
Fixed
94e25d9de158bc10b6a74d9aad75944b1a68ee13
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "6.54.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70594.json"