{"id":"CVE-2026-104416","published":"2026-10-02T12:17:11.420","lastModified":"2026-10-06T03:16:59.930","description":"Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-203"],"vendors":[],"products":[],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v","tags":[]},{"url":"https://www.vulncheck.com/advisories/ghost-4.39.0-before-6.64.0-invite-token-disclosure-via-admin-api","tags":[]}],"exploitRefs":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v","tags":[]}],"hasPoc":true,"ai":{"summary":"A vulnerability in Ghost's Admin API allows staff users to view secret tokens for pending staff invites, enabling them to accept invites for higher-privileged roles and escalate their access level.","exploitability":"Exploitation requires a staff user with invite viewing permissions to access the Admin API and retrieve secret tokens from pending invites, which is moderately difficult due to the need for specific permissions but not complex.","blast_radius":"The vulnerability could allow attackers to gain elevated privileges across multiple user roles in Ghost CMS installations, potentially leading to full administrative control of the platform.","remediation":"Upgrade to Ghost 6.64.0 or later to remediate this information disclosure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["information-disclosure","privilege-escalation","admin-api"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:03:54.614Z"}}