CVE-2026-70596

{
  "id": "CVE-2026-70596",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T16:17:03.463",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1."
    },
    {
      "lang": "es",
      "value": "Ghost es un sistema de gestión de contenido Node.js. Desde la versión 4.9.0 hasta la 6.54.1, un problema de validación de entrada permitía a cualquier usuario del personal crear una publicación con contenido en feature_image_caption que podía usarse para secuestrar la sesión de administrador de Ghost de otro usuario del personal, lo que resultaba en una escalada de privilegios. Este problema está solucionado en la versión 6.54.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TryGhost",
          "product": "Ghost",
          "versions": [
            {
              "version": ">= 4.9.0, < 6.54.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T17:31:33.896500Z",
          "id": "CVE-2026-70596",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/pull/29635",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-pr22-p9rp-2cqv",
      "source": "[email protected]"
    }
  ]
}