Privilege Escalation Vulnerability in Ghost Notifications System by Ghost

CVE-2026-103286

What is CVE-2026-103286?

Ghost versions from 2.21.0 before 6.56.0 are susceptible to a privilege escalation vulnerability within the notifications system. This flaw permits low-privilege staff users to gain unauthorized access to higher-privilege roles. Attackers can exploit this vulnerability to elevate their privileges without undergoing necessary authorization checks, potentially leading to unauthorized actions within the platform.

References