Ghost 5.42.2 through 6.57.x includes an information‑disclosure flaw in the Admin API bulk post and page edit/delete endpoints. The flaw arises because these endpoints accept filters on restricted fields such as authors.password, allowing a staff‑level attacker to determine which staff users’ password hashes match a given filter. Once the hashes are known, the attacker can perform offline password‑guessing attacks against those accounts. The primary impact is the exposure of credential hashes, which raises confidentiality risk and allows further compromise of staff accounts.

TryGhost Ghost is affected by this vulnerability in all releases prior to version 6.58.0, including the 5.42.2 release. Only the Ghost CMS product is impacted; there are no known affected extensions or third‑party plugins listed in the advisory.

The CVSS score of 5.3 indicates a moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, but the attack requires staff‑level authentication and access to the Admin API. Once those prerequisites are met, the vulnerability can be exploited relatively easily, making it a concern for environments where staff permissions are broad or poorly governed.