CVE-2026-105678

MEDIUMCVSS 4.3

Description

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 7th, 2026 10:17 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-269 CWE-863

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf
https://github.com/TryGhost/Ghost/issues/30764
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc

Source: NIST NVD · Data may lag official sources by up to one minute