CVE-2026-103273 is an authentication bypass vulnerability in TryGhost Ghost affecting versions from 4.3.0 to before 6.58.0. The vulnerability permits staff users with limited privileges to leverage staff tokens to circumvent post editing restrictions, enabling unauthorized editing of posts beyond their privilege scope. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, and requiring low privileges without user interaction.

Attackers with staff credentials can exploit this vulnerability to edit posts they are not authorized to modify, potentially leading to unauthorized content changes within the Ghost platform. There is no indication of privilege escalation beyond staff-level or other impacts such as data disclosure or service disruption.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict staff user privileges carefully and monitor for unauthorized post edits.