CVE-2026-70594

Published: Aug 4, 2026Modified: Sep 8, 2026Deferred

6.7

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Exploitability: 1.2 / Impact: 5.5

Source: security-advisories@github.com (Secondary)

Description

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (4)

https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/pull/29634

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/releases/tag/v6.54.1

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh

Source: security-advisories@github.com

Timeline

No history available yet.