CVE-2026-104412

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.0 through 6.63.x

Description Ghost fails to correctly restrict staff role assignment. This allows authenticated users with the Editor or Super Editor role to assign their own role to other staff members, even though they lack the necessary permissions. Consequently, an Editor or Super Editor can promote users with Author or Contributor roles to Editor or Super Editor status.

Recommendations Update Ghost to version 6.64.0 or later.