Information Disclosure Vulnerability in Ghost CMS by Ghost Foundation
CVE-2026-104416

7.7HIGH

Key Information:

Vendor

Tryghost

Status
Ghost
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104416?

An information disclosure vulnerability exists in Ghost CMS versions prior to 6.64.0, affecting the Admin API. This flaw allows staff users with appropriate permissions to retrieve secret tokens tied to pending staff invites. By exploiting this vulnerability, an attacker with invite viewing rights can potentially accept invites for roles with greater privileges, leading to unauthorized escalation of their access within the system.

Affected Version(s)

Ghost 4.39.0 < 6.64.0

Ghost 6.64.0

References

https://github.com/TryGhost/Ghost/security/advisories/GHS...
vendor-advisory
https://www.vulncheck.com/advisories/ghost-4.39.0-before-...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nhattanhh
.