Ghost, a Node.js content management system, contains a weakness that lets any staff‑level user determine the relative ordering of other staff users’ hashed passwords through the Admin API. The vulnerability does not expose the actual hashes and does not provide a practical route to password recovery. The flaw is rooted in information exposure (CWE‑203) and a lack of proper data handling (CWE‑943).

The affected product is Ghost by TryGhost. Versions from 0.7.2 up to but not including 6.64.0 are vulnerable; the issue is fixed in 6.64.0 and later releases.

The CVSS score of 3.1 indicates a low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a modest exploitation probability. The likely attack path requires an authenticated staff‑level account to access the Admin API; an attacker with such privileges could infer relative hash ordering, which, while not directly yielding passwords, may aid subsequent credential guessing or social engineering attempts. Overall, the risk is considered moderate to low, but vigilance is advised when staff credentials are compromised.