CVE-2026-70594: Session Fixation in Ghost Admin Panel

The Ghost content management system uses an Express-based backend to manage administrator authentication and session states. The administration interface, known as Ghost Admin, exposes API endpoints designed to authenticate users and issue session tokens. Historically, this authentication workflow accepted existing session cookies without validating whether they were established prior to authentication.

This behavior exposes the application to session fixation vulnerabilities categorized under CWE-384. By maintaining the same session identifier before and after a user logs in, the backend fails to separate unauthorized and authorized states. If an attacker can inject a chosen session ID into a victim's browser, the attacker can hijack the session once the victim authenticates.

The vulnerability originates in the administrative session establishment process managed by the createSessionForUser function in the authentication service. When an administrator authenticates via the /ghost/api/admin/session/ endpoint, the server processes the login request and updates the current session state stored in the backend database. However, the system does not generate a new cryptographic session key.

Instead, the server maps the authenticated user metadata onto the existing, pre-login session object associated with the incoming request. Because this pre-login session identifier remains completely unchanged, any party holding the original cookie gains immediate administrative privileges upon the user's successful authentication. Successful exploitation relies on a secondary mechanism to plant the pre-login cookie, such as cookie tossing from a co-hosted subdomain or exploiting local cross-site scripting.

In vulnerable versions of Ghost, the session setup routine directly retrieved and modified the existing session object. The following code demonstrates the lack of session regeneration:

// Vulnerable Implementation
async function createSessionForUser(req, res, user) {
    const session = await getSession(req, res);
    const origin = getOriginOfRequest(req);
    await assignUserToSession({
        session,
        user,
        origin
    });
}

The fix introduced in version 6.54.1 remediates this flaw by invoking the regenerate() function provided by express-session. This method destroys the previous session identifier and replaces it with a new, cryptographically secure token. The patch also copies necessary metadata, such as multi-factor authentication challenges, while isolating user contexts:

// Patched Implementation in v6.54.1
async function createSessionForUser(req, res, user) {
    const previousSession = await getSession(req, res);
 
    const {
        user_id: previousUserId,
        verified: previousVerified,
        auth_code_challenge: previousAuthCodeChallenge,
        auth_code_generated_at: previousAuthCodeGeneratedAt
    } = previousSession;
 
    await new Promise((resolve, reject) => {
        req.session.regenerate((err) => {
            if (err) {
                reject(err);
                return;
            }
            resolve();
        });
    });
 
    const session = req.session;
    session.user_id = previousUserId;
    session.verified = previousUserId && previousUserId !== user.id ? undefined : previousVerified;
    session.auth_code_challenge = previousAuthCodeChallenge;
    session.auth_code_generated_at = previousAuthCodeGeneratedAt;
 
    const origin = getOriginOfRequest(req);
    await assignUserToSession({
        session,
        user,
        origin
    });
}

Exploitation of CVE-2026-70594 requires the attacker to plant a known session cookie into the target user's browser. Since Ghost Admin restricts cookie paths, the attacker must bypass domain isolation boundaries to perform a cookie injection or cookie tossing attack. This requires hosting a malicious application on a sibling subdomain or exploiting a secondary vulnerability on the same parent domain.

Once the victim's browser is loaded with the fixated cookie, the victim visits the Ghost Admin panel and enters their credentials. The Ghost server updates the backend storage associated with the fixated cookie. The attacker, who already possesses this cookie value, can then access administrative endpoints directly without prompting for credentials.

Successful exploitation of this session fixation vulnerability grants the attacker full administrative access to the Ghost CMS backend. Administrative access allows the compromise of publishing rights, enabling attackers to inject malicious scripts, modify public articles, or deface the site. Furthermore, the attacker gains access to the database of registered users, API keys, and system configuration settings.

The CVSS v3.1 base score is 6.7, reflecting a Medium severity rating. The attack vector is restricted to adjacent networks or specific local-domain topologies due to cookie domain constraints. High confidentiality, integrity, and availability impacts are limited only by the privileges associated with the targeted administrator account.

To remediate the vulnerability, deployers must update their installations to Ghost version 6.54.1 or later. This version incorporates the req.session.regenerate() logic to ensure immediate invalidation of the pre-login session. To apply the patch, run ghost update within the server command-line interface.

In environments where patching cannot be completed immediately, apply defense-in-depth domain isolation. Do not co-host untrusted applications on sibling subdomains of the same parent domain. Configure reverse proxies to set the HostOnly attribute on administrative cookies and enforce strict SameSite=Lax or SameSite=Strict directives to limit unauthorized session manipulation.