CVE-2026-105678

Received Received - Intake

Ghost CMS Staff Role Privilege Escalation Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105678

EUVD

EUVD-2026-92769

Affected Vendors & Products

Vendor	Product	Version / Range
TryGhost	Ghost	>= 0.5.0, < 6.64.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Ghost CMS allows staff users with Editor or Super Editor roles to assign their own role to lower-privilege users like Authors and Contributors, despite lacking permission to do so. The issue was due to insufficient validation when editing user roles, enabling unauthorized role escalation.

Detection Guidance

To detect this vulnerability, check Ghost CMS user role assignments in versions before 6.64.0. Review logs for unauthorized role changes by Editors or Super Editors. Use Ghost CLI or database queries to audit user roles and compare against expected permissions.

Impact Analysis

An attacker with Editor or Super Editor privileges could escalate their own or others' roles to higher privileges, potentially gaining unauthorized access to sensitive content or administrative functions. This could lead to data breaches or system misuse.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and role-based permissions, such as GDPR's data protection principles or HIPAA's access control safeguards. Unauthorized role escalation may lead to unauthorized data access or processing.

Mitigation Strategies

Update Ghost CMS to version 6.64.0 or later to patch the vulnerability. Use Docker or Ghost-CLI to upgrade your installation.

Hi! I’m here to help you understand CVE-2026-105678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70