CVE-2026-105675 in Ghost
Summary
by MITRE • 10/06/2026
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as CVE-2023-5781 represents a critical authorization flaw within the Ghost content management system, specifically affecting versions ranging from 4.39.0 through 6.64.0. This issue stems from an improper implementation of access controls regarding staff invitation tokens. In typical deployment scenarios for platforms like Ghost, administrators generate unique secret tokens to invite new users into the organization. These tokens serve as a secure mechanism for onboarding personnel without requiring them to have prior account credentials or direct administrative intervention during the initial acceptance phase. The security model relies heavily on the confidentiality of these tokens until they are consumed by the intended recipient. However, in the affected versions, this assumption was violated due to insufficient validation checks when staff users with limited privileges attempted to interact with invitation-related endpoints.
The core technical flaw lies in the API endpoint responsible for retrieving details about pending invitations. While Ghost correctly restricts which roles can create or delete invites, it failed to adequately restrict read access to the specific data fields containing the secret invite token. Users assigned a staff role that included permission to view existing staff invites were inadvertently granted visibility into the full payload of those invitation records. This exposure includes not only basic information such as email addresses and target roles but also the cryptographic secret required to authenticate and accept the invitation. Consequently, any authenticated user possessing this specific read permission could enumerate pending invitations for other users within the system.
The operational impact of this vulnerability is severe due to its potential for privilege escalation. An attacker with a lower-privileged staff account can leverage this information leak to target higher-level accounts, such as those belonging to administrators or editors. By identifying a pending invite intended for an administrator and extracting its associated secret token, the malicious actor can accept that invitation using their own existing session or by creating a new one if necessary. This action effectively allows the attacker to assume the identity of the invited user, thereby inheriting all permissions associated with that higher-privilege role. Once escalated, the attacker gains unrestricted access to sensitive content, configuration settings, and potentially full control over the Ghost instance, depending on the scope of the elevated privileges.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically where an actor is able to bypass or circumvent established security boundaries due to flawed logic in authorization checks. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, this flaw facilitates lateral movement and privilege escalation techniques often categorized under Account Manipulation or Abuse of Existing Cloud Infrastructure. The attack vector relies on valid authentication but exploits weak vertical access control mechanisms rather than breaking out of an isolated sandbox or exploiting buffer overflows. It highlights the importance of principle of least privilege in API design, ensuring that read permissions do not inadvertently expose sensitive secrets required for higher-level actions.
Mitigation strategies primarily involve upgrading to version 6.64.0 or later, where this logic error has been corrected by restricting access to the invite token field based on stricter role-based criteria. For organizations unable to immediately patch their systems due to operational constraints, temporary mitigations should focus on auditing user permissions within Ghost. Administrators should review which staff members have been granted permission to view invites and revoke this specific capability for any users who do not strictly require it for their job functions. Additionally, implementing strict monitoring of invitation acceptance events can help detect anomalous activity where a low-privilege account accepts an invite intended for a high-privilege role. Regular security audits focusing on API endpoint authorization logic are recommended to prevent similar flaws in future updates or custom integrations.