Ghost Admin API Information Disclosure via Pending Staff Invites

Executive Summary

CVE-2026-104416 is an information disclosure vulnerability in Ghost versions 4.39.0 to 6.64.0. It allows staff users with invite viewing permission to see secret tokens of pending staff invites, including those for higher-privileged roles. This enables privilege escalation by accepting pending invites for elevated access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Ghost versions between 4.39.0 and 6.63.0. Use commands like 'ghost version' for CLI or inspect Docker image tags. Review Admin API logs for unusual invite token access patterns. Verify staff user permissions for invite viewing access.

Useful 0 Not Useful 0

Impact Analysis

If you are a Ghost user running a vulnerable version, an attacker with staff access could exploit this to escalate their privileges. This could lead to unauthorized access to sensitive data, control over the Ghost instance, or further compromise of the system hosting Ghost.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance breaches, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Ghost to version 6.64.0 or later using Docker or Ghost-CLI. Remove unnecessary staff user permissions, especially invite viewing access. Monitor for unauthorized privilege escalation attempts and rotate all staff invite tokens as a precaution.

Useful 0 Not Useful 0