CVE-2026-103267 affects Ghost versions from 0.5.0 up to but not including 6.62.0. The vulnerability arises from reliance on untrusted inputs during a security decision in the staff invite acceptance workflow. Specifically, users can specify any email address when accepting an invite token, enabling attackers to register accounts with attacker-controlled emails or legitimate invitees to register with unintended email providers. This results in an authentication bypass scenario.

The vulnerability allows attackers or unauthorized users to bypass authentication controls by accepting invite tokens with arbitrary email addresses. This could lead to unauthorized account creation and potential misuse of staff privileges. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low attack complexity, and no user interaction required.

A fix is available in Ghost version 6.62.0. Users should upgrade to version 6.62.0 or later to remediate this vulnerability. There is no indication that temporary mitigations are available or that no action is required.