CVE-2026-105678
Ghost: Editors Could Promote Staff Users to Their Own Role
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.
| CWE | CWE-269 CWE-863 |
| Vendor | tryghost |
| Product | ghost |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for tryghost ghost
Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
TryGhost / Ghost
>= 0.5.0, < 6.64.0
References
github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc github.com: https://github.com/TryGhost/Ghost/issues/30764 github.com: https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.64.0