---
id: CVE-2026-70594
title: Ghost is a Node.js content management system
summary: >-
  Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost
  Admin did not invalidate existing sessions on login which could have allowed
  for session fixation attacks. Successful exploitation would have required
  another v…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L'
cwe:
  - CWE-384
vendor: ghost
product: ghost
affected:
  - 'ghost >= 2.2.0, < 6.54.1'
patched:
  - ghost 6.54.1
published: '2026-08-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70594'
references:
  - url: >-
      https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/pull/29634'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/releases/tag/v6.54.1'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-7mpp-r37j-x5wh'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00244
epssPercentile: 0.13908
aliases:
  - GHSA-7mpp-r37j-x5wh
ecosystem: npm
ingestedAt: '2026-08-04T22:42:37.944Z'
---

## Overview

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-70594)

Affected packages:

- `ghost >= 2.2.0, < 6.54.1`

Patched in:

- `ghost 6.54.1`

Source: https://github.com/advisories/GHSA-7mpp-r37j-x5wh