CVE-2026-103267

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.62.0

Description An authentication bypass exists during the staff invite acceptance process. This issue allows users to specify any email address when creating their account, enabling attackers to use leaked invite tokens with email addresses they control. Additionally, legitimate recipients may register using unintended email providers.

Recommendations Update to version 6.62.0 or later.