CVE-2026-104416 in Ghost
Summary
by MITRE • 10/02/2026
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability resides within the administrative application programming interface (API) of Ghost, specifically affecting versions ranging from 4.39.0 up to but not including version 6.64.0. This flaw constitutes a critical information disclosure issue that exposes sensitive authentication material in the form of secret tokens associated with pending staff invitations. The vulnerability is triggered when an authenticated user possessing specific permissions related to viewing invites interacts with the API endpoints responsible for listing or retrieving invitation details. Instead of masking or omitting these high-value credentials, the system returns them in plaintext within the response payload, thereby violating fundamental principles of secure data handling and credential management.
From a technical perspective, this flaw represents an improper restriction of information flow to unauthorized actors, albeit with a nuanced access control dynamic. While the vulnerability is technically accessible only by staff users who have been granted explicit permission to view invites, it enables privilege escalation through social engineering or internal compromise mechanisms. The secret tokens serve as one-time use credentials that allow individuals to accept invitations and assume higher-privileged roles within the platform. By exposing these tokens, the application effectively bypasses the intended security boundary between lower-level staff members and administrative accounts. This aligns with Common Weakness Enumeration (CWE) category CWE-209, which describes an information exposure through an error message that reveals implementation details, or more accurately in this context, CWE-359 regarding exposed private personal information, as the tokens are effectively private keys for account creation and role assignment.
The operational impact of this vulnerability is severe due to its direct correlation with privilege escalation. An attacker who gains access to a staff account with invite-viewing permissions can extract these secret tokens from pending invitations intended for administrators or other high-privilege roles. By utilizing the exposed token, the attacker can accept the invitation and thereby elevate their own privileges within the Ghost instance. This capability allows for full administrative control over the platform, including the ability to modify site settings, access user data, inject malicious code into themes or posts, and potentially compromise downstream systems if integrated with external services. The attack vector is classified under MITRE ATT&CK technique T1078, Valid Accounts, specifically focusing on privilege escalation through compromised credentials or tokens obtained via information disclosure.
Mitigation strategies must address both the immediate exposure of data and the underlying architectural flaw in how invitation tokens are handled. The primary remediation step for affected organizations is to upgrade Ghost to version 6.64.0 or later, where this vulnerability has been patched by ensuring that secret tokens are not returned in API responses intended for staff users with invite viewing permissions. In addition to upgrading, administrators should audit existing user roles and ensure that the principle of least privilege is strictly enforced, minimizing the number of staff accounts granted permission to view pending invites. It is also recommended to rotate any potentially compromised invitation tokens if there is evidence of unauthorized access or suspicious activity within the administrative logs. Implementing robust logging and monitoring for API requests involving invite management can help detect attempts to exploit this information disclosure in real-time, providing an additional layer of defense against privilege escalation attacks.