CVE-2026-105678

4.3 MEDIUMpublic exploit available

Published 2026-10-05 · Updated 2026-10-07

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-269, CWE-863

Public exploit & PoC references

https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf
https://github.com/TryGhost/Ghost/issues/30764
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc

All references

https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf
https://github.com/TryGhost/Ghost/issues/30764
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-105687PoC
HIGHCVE-2026-106492PoC
HIGHCVE-2026-110724PoC
UNSCOREDCVE-2026-56733PoC
HIGHCVE-2026-94609PoC
HIGHCVE-2024-22031PoC
HIGHCVE-2024-58390PoC
MEDIUMCVE-2025-14123

Related by shared AI tags and CWE weakness class. Browse the full archive.