Ghost CMS Staff Role Privilege Escalation Vulnerability

Executive Summary

This vulnerability in Ghost CMS versions 0.5.0 to 6.64.0 allows users with Editor or Super Editor roles to assign their own role to other staff members without proper permissions. This enables them to promote lower-level users like Authors and Contributors to higher roles such as Editor or Super Editor.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Ghost CMS versions between 0.5.0 and 6.64.0. Use commands like 'ghost version' in the Ghost CLI or check Docker image tags for affected versions. Review staff role assignments in the Ghost admin panel for unauthorized promotions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Editor or Super Editor access could escalate their privileges or those of other users, potentially gaining unauthorized control over the Ghost CMS instance. This could lead to unauthorized content modifications, data access, or system manipulation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, potentially violating data protection requirements under GDPR or HIPAA. Unauthorized role changes may result in improper access to sensitive data, compromising compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Ghost to version 6.64.0 or later using Ghost-CLI or Docker. Remove unauthorized role assignments in the admin panel. Monitor staff accounts for suspicious activity and restrict Editor/Super Editor permissions until patched.

Useful 0 Not Useful 0