CVE-2026-104416

HIGHCVSS 7.5

Description

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.

Timeline

Published:October 2nd, 2026 12:17 PM

Last modified:October 6th, 2026 3:16 AM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-203

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v
https://www.vulncheck.com/advisories/ghost-4.39.0-before-6.64.0-invite-token-disclosure-via-admin-api

Source: NIST NVD · Data may lag official sources by up to one minute