CyberRota Analysis
AI-GeneratedAn information disclosure vulnerability exists in the Admin API of Ghost versions prior to 6.64.0, allowing authenticated staff users to infer the relative ordering of other staff users' password hashes. While this does not directly expose the hashes or facilitate password recovery, it could potentially aid in targeted attacks against user accounts. Organizations using affected versions should prioritize patching to mitigate any risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.