CVE-2026-103266 is an incorrect authorization vulnerability in TryGhost Ghost affecting versions 5.2.0 up to but not including 6.62.0. It permits remote attackers without authentication to abuse the Stripe Checkout process to associate a paid subscription with an existing member account, alter the member's name, and inject arbitrary content into newsletters sent to that member. The injected content may be rendered by the recipient's email client, resulting in HTML injection or XSS. The CVSS 4.0 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on integrity and availability.

An unauthenticated remote attacker can manipulate subscription and member data, potentially leading to unauthorized subscription attachments, member identity modifications, and injection of malicious content into newsletters. This may result in HTML injection or cross-site scripting attacks when the newsletter is viewed, compromising the integrity of member communications and potentially impacting recipients.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Stripe Checkout flow if possible and monitor for suspicious activity related to member subscriptions and newsletter content.