CVE-2026-103282 describes a race condition vulnerability in the TryGhost Ghost platform affecting versions >=0.5.0 and <6.23.0. The flaw exists in the mechanism that handles staff invitation acceptance, where improper synchronization allows concurrent requests using the same invitation token to result in multiple user accounts being created. This concurrency issue can be exploited by submitting simultaneous requests with the identical invite token, bypassing intended single-use restrictions.

An attacker can create multiple user accounts from a single invitation token, potentially leading to unauthorized account creation and misuse of invitation privileges. The vulnerability does not require user interaction and can be exploited remotely with low attack complexity and low privileges. The impact is limited to account creation duplication and does not indicate privilege escalation or data compromise.

A fix is available in Ghost version 6.23.0 and later. Users should upgrade to version 6.23.0 or above to remediate this race condition vulnerability. No additional mitigation steps are indicated.