CVE-2026-70594 — MEDIUM (6.7)

Vulnerability Description

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

CVSS Score

6.7

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Related Weaknesses (CWE)

CWE-384

References

FAQ

What is CVE-2026-70594?

CVE-2026-70594 is a vulnerability with a CVSS score of 6.7 (MEDIUM). Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful explo...

How severe is CVE-2026-70594?

CVE-2026-70594 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-70594?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.