CVE-2026-103267 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The Ghost content management platform prior to version 6.62.0 contains a critical authentication bypass vulnerability within the staff invitation acceptance workflow. This flaw stems from insufficient validation of user-supplied input during the account creation process triggered by an invite token. Specifically, when a recipient accepts a staff invitation, the application fails to enforce strict binding between the email address associated with the invited identity and the email address provided or used in the registration payload. Consequently, an actor can manipulate this field to specify any arbitrary email address rather than being restricted to the one originally intended by the administrator who issued the invite token. This lack of input validation represents a fundamental failure in access control logic, allowing for significant abuse of the authentication mechanism.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, and more specifically CWE-501, Trust Boundary Violation, as the system fails to maintain trust boundaries between the invitation issuance context and the account creation execution context. The attacker leverages this flaw by obtaining or guessing a valid staff invite token, often through leaked data from previous breaches or social engineering tactics that compromise administrative communications. Once in possession of such a token, the malicious actor submits it along with an email address under their control rather than the original recipient's address. This allows them to create a new account associated with their chosen identity while retaining the elevated privileges granted by the staff invite role. The vulnerability effectively decouples the authentication credential from the intended user identity, undermining the integrity of the administrative access model.
The operational impact of this vulnerability is severe for organizations relying on Ghost for internal collaboration or content management. An attacker who successfully exploits this flaw gains unauthorized administrative access to the platform without needing valid credentials for a specific existing account. This level of access typically includes the ability to manage users, modify site settings, publish or delete content, and potentially execute further attacks depending on installed integrations or plugins. If an internal employee inadvertently accepts an invite using their personal email provider instead of their corporate domain due to this flaw, it could lead to unintended data exposure if that personal account is compromised later. Furthermore, the ability to register with any email address facilitates identity spoofing and makes forensic tracking more difficult for security teams attempting to attribute malicious activity within the platform.
Mitigation strategies must focus on immediate patching and enhanced input validation practices. The primary remediation is upgrading Ghost to version 6.62.0 or later, where this logic error has been corrected by enforcing strict email address binding during the invite acceptance process. Administrators should also implement defense-in-depth measures such as requiring multi-factor authentication for all staff accounts to reduce the value of stolen tokens alone. Additionally, organizations should audit their invitation issuance processes to ensure that sensitive administrative invites are transmitted through secure channels and monitored for unauthorized usage. Regular security assessments focusing on access control logic flaws similar to CWE-284 will help identify other potential weaknesses in user management workflows before they can be exploited by adversaries leveraging techniques documented under MITRE ATT&CK T1078, Valid Accounts, specifically the sub-technique of Initial Access via stolen credentials or tokens.