PT-2026-103800

CVE-2026-103267

Published

2026-10-01

Updated

2026-10-09

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.62.0

Description An authentication bypass exists during the staff invite acceptance process. This issue allows users to specify any email address when creating their account, enabling attackers to use leaked invite tokens with email addresses they control. Additionally, legitimate recipients may register using unintended email providers.

Recommendations Update to version 6.62.0 or later.

Exploitability

Exploit

Fix

Researchers

Doanmanhducz

Eclipssec

Unknownhad

Vendors

Affected products

Weakness enumeration

CWE-807: Reliance on Untrusted Inputs in a Security Decision