{"id":"CVE-2026-105675","published":"2026-10-05T20:17:14.367","lastModified":"2026-10-06T17:17:18.137","description":"Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-203","CWE-943"],"vendors":[],"products":[],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f","tags":[]},{"url":"https://github.com/TryGhost/Ghost/pull/30760","tags":[]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","tags":[]},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v","tags":[]}],"exploitRefs":[{"url":"https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f","tags":[]},{"url":"https://github.com/TryGhost/Ghost/pull/30760","tags":[]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","tags":[]},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v","tags":[]}],"hasPoc":true,"ai":{"summary":"A Ghost CMS vulnerability allows staff users to discover secret tokens for pending invites, enabling privilege escalation by accepting higher-privilege invites. This affects versions 4.39.0 through 6.64.0.","exploitability":"The exploit requires a staff user with invite viewing permissions to access pending invites, making it moderately difficult to exploit but not requiring advanced technical skills.","blast_radius":"If exploited, this vulnerability could allow attackers to gain administrative privileges in Ghost CMS installations, potentially leading to full system compromise and content manipulation.","remediation":"Upgrade to version 6.64.0 or later to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","ghost-cms","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:08.135Z"}}