CVE-2026-104416

Summary

A vulnerability in Ghost's Admin API allows staff users to view secret tokens for pending staff invites, enabling them to accept invites for higher-privileged roles and escalate their access level.

Exploitability

Exploitation requires a staff user with invite viewing permissions to access the Admin API and retrieve secret tokens from pending invites, which is moderately difficult due to the need for specific permissions but not complex.

Blast radius

The vulnerability could allow attackers to gain elevated privileges across multiple user roles in Ghost CMS installations, potentially leading to full administrative control of the platform.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ghost 6.64.0 or later to remediate this information disclosure vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.