Vulnerability in Tryghost Ghost
CVE-2026-70594
Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vul…
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L.
Affected products
- Tryghost Ghost — versions >= 2.2.0, < 6.54.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-70594?
- CVE-2026-70594 is a medium-severity vulnerability in Tryghost Ghost, classified under Session Fixation. CVSS score: 6.7/10. Published 2026-08-04.
- How severe is CVE-2026-70594?
- Medium severity. CVSS v3 base score is 6.7 out of 10.