CVE-2026-104412: Improper Privilege Management in TryGhost Ghost
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
AI Analysis
Technical Summary
CVE-2026-104412 describes a privilege escalation vulnerability in the TryGhost Ghost platform affecting versions >=0.5.0 and <6.64.0. The vulnerability arises because the software does not correctly restrict staff role assignments, enabling users with Editor or Super Editor roles to elevate other users' roles without proper authorization. This improper privilege management can lead to unauthorized role promotions within the staff user base.
Potential Impact
An authenticated user with Editor or Super Editor privileges can promote other users (Authors or Contributors) to higher privileged roles (Editor or Super Editor). This could lead to unauthorized access and increased privileges within the Ghost platform, potentially allowing further unauthorized actions by those promoted users.
Mitigation Recommendations
A fix is available in Ghost version 6.64.0. Users should upgrade to version 6.64.0 or later to remediate this vulnerability.
CVE-2026-104412: Improper Privilege Management in TryGhost Ghost
Description
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
CVSS v4.0
Score 5.3medium
Affected software
TryGhost
Ghost
pkg:github/tryghost/GhostRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104412 describes a privilege escalation vulnerability in the TryGhost Ghost platform affecting versions >=0.5.0 and <6.64.0. The vulnerability arises because the software does not correctly restrict staff role assignments, enabling users with Editor or Super Editor roles to elevate other users' roles without proper authorization. This improper privilege management can lead to unauthorized role promotions within the staff user base.
Potential Impact
An authenticated user with Editor or Super Editor privileges can promote other users (Authors or Contributors) to higher privileged roles (Editor or Super Editor). This could lead to unauthorized access and increased privileges within the Ghost platform, potentially allowing further unauthorized actions by those promoted users.
Mitigation Recommendations
A fix is available in Ghost version 6.64.0. Users should upgrade to version 6.64.0 or later to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:44:44.528Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf99ada43b0b3b89b26746
Added to database: 10/02/2026, 11:46:53 UTC
Last enriched: 10/02/2026, 12:18:03 UTC
Last updated: 10/02/2026, 21:28:57 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.