Nhattanhh

Staff users assigned the Editor or Super Editor roles can assign their own role to users with Author or Contributor roles, bypassing the intended permission restrictions.

SVG media thumbnails and SVG images uploaded with a non-SVG file extension are stored without sanitization. This allows staff users, including those with Contributor roles, to host malicious scripts on the site domain, which could lead to the compromise of administrative sessions of other staff users.

Embedding a URL from an attacker-controlled website can lead to the storage of untrusted scripts within post content. These scripts may execute in the editor, on the published site, and in newsletter emails, which could lead to the compromise of a staff user's admin session.

Staff-level users can determine the relative ordering of hashed passwords belonging to other staff users. This issue does not directly disclose the password hashes or provide a practical method for password recovery.

Staff users with permission to view staff invites can discover the secret token of pending invites. This includes invites for roles with higher privileges than the user's own, which could allow a staff user to escalate their privileges by accepting a pending invite.

A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server. This type of flaw is known as Server-Side Request Forgery (SSRF), where the server is coerced into making requests to an unintended location. In this case, no response data is returned to the attacker.

A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server on certain network configurations. This type of flaw, where a server is coerced into making requests to an internal resource, is known as Server-Side Request Forgery (SSRF). In this case, a successful attack does not return any response data to the attacker.

A stored cross-site scripting issue exists where untrusted scripts can be injected into post content through oEmbed photo responses. An attacker can host a malicious oEmbed photo response; when the URL is embedded, the scripts are stored and subsequently executed within the Ghost editor, the published site, and newsletter emails. This can lead to the compromise of staff admin sessions.

An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is achieved by querying the Admin API to infer hash ordering, although the flaw does not directly expose the hashes or facilitate practical password recovery.

An information disclosure issue exists in the Admin API that allows staff users to view secret tokens associated with pending staff invites. Staff users who possess invite viewing permissions can use these tokens to accept pending invites for roles with higher privileges, leading to privilege escalation.

Ghost fails to correctly restrict staff role assignment. This allows authenticated users with the Editor or Super Editor role to assign their own role to other staff members, even though they lack the necessary permissions. Consequently, an Editor or Super Editor can promote users with Author or Contributor roles to Editor or Super Editor status.