VulnerabilityDeferred

CVE-2026-70594

From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks.

MEDIUM 6.7EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

CVSS 3.1: 6.7 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
EPSS: 0.16% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-384
Source: security-advisories@github.com

References

https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c
https://github.com/TryGhost/Ghost/pull/29634
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.