CVE-2026-105675

Summary

A Ghost CMS vulnerability allows staff users to discover secret tokens for pending invites, enabling privilege escalation by accepting higher-privilege invites. This affects versions 4.39.0 through 6.64.0.

Exploitability

The exploit requires a staff user with invite viewing permissions to access pending invites, making it moderately difficult to exploit but not requiring advanced technical skills.

Blast radius

If exploited, this vulnerability could allow attackers to gain administrative privileges in Ghost CMS installations, potentially leading to full system compromise and content manipulation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 6.64.0 or later to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.