Authentication Bypass in Ghost Allows Unintended Email Registrations

CVE-2026-103267

What is CVE-2026-103267?

Ghost versions prior to 6.62.0 exhibit a flaw that permits an authentication bypass during staff invite acceptance. This vulnerability allows users to specify any email address when creating their accounts. Attackers can exploit this by accepting leaked invite tokens using email addresses they control, while legitimate users may unintentionally register with undesired email providers. It poses a significant risk to the integrity of the user registration process in the Ghost CMS.

References