The vulnerability allows any staff-level user to request the hashed passwords of other staff accounts via the Ghost Admin API. Exposed hash values can be subjected to offline brute‑force or dictionary attacks, potentially yielding plain‑text passwords and enabling account takeover. Although Ghost’s Device Verification will block a forged login even if a password is recovered, the disclosure still represents a breach of confidential credential data and a path to compromised staff accounts.

This flaw exists in Ghost releases older than 6.54.1, released by TryGhost. All staff‑level users of those versions are potentially affected, regardless of the database backend.

The CVSS score of 4.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. The primary attack vector is the authenticated Admin API, so an attacker must first obtain staff credentials or compromise an already‑trusted staff account. Once hash data is retrieved, exploitation requires only offline processing; no network interaction is needed after the data export.