Skip to content
Log inStart free trial

GHSA-v6q3-xqxm-6f5v BIT-ghost-2026-104416 BIT-ghost-2026-105675 CVE-2026-104416 CVE-2026-105675

Ghost: Invite Token Disclosure in Ghost Admin API

High npm
Severity
7.7 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.40%
Chance of exploitation in the next 30 days. Higher than 33.69% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-203 Observable Discrepancy
CWE-943 Improper Neutralization of Special Elements in Data Query Logic
Fix
6.64.0
Upgrade ghost to this version or later

Description

Impact

Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite.

Vulnerable versions

This vulnerability is present in Ghost from v4.39.0 up to v6.64.0.

Patches

v6.64.0 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks CoryRoo, Pedro Pinho, and Nhat Anh Vu for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at security@ghost.org.

Affected versions

npm

PackageVulnerableFixed in
ghost
>= 4.39.0, < 6.64.0
6.64.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ghost npm → 6.64.0

npm
npm install ghost@6.64.0
yarn
yarn add ghost@6.64.0
pnpm
pnpm add ghost@6.64.0

Severity breakdown

CVSS 4.0 7.7

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Network
Attack complexity
High
Attack requirements
Present
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Not defined
Scope
X

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-203: Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

How to prevent it
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
  • Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-x3mg-q38v-m562
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Medium Also affects ghost
GHSA-8575-cr6v-7jh4
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
High Also affects ghost
GHSA-r7f2-6fj8-6fg2
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Medium Also affects ghost
GHSA-322m-ff4g-9vx9
Ghost: Server-Side Request Forgery in Bookmark Fetching
Medium Also affects ghost
GHSA-fwh9-qg68-vxp4
Ghost: Regular Expression Denial of Service in Content Import
Medium Also affects ghost
GHSA-9m4w-fmjw-fvjq
Ghost: Regular Expression Denial of Service in External Media Inliner
Medium Also affects ghost
GHSA-hqq2-xqr2-fmx2
Ghost : Stored XSS via SVG Files in Content Imports
Medium Also affects ghost
GHSA-69qc-f5m6-889c
Ghost: Stored XSS via Embed Card Previews
High Also affects ghost
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor