Is CVE-2026-70596 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-70596?

CVE-2026-70596 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-70596

Description

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.