High
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
Announced Group revision 1
Original source ↗CVE-2026-104416
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104416
Ghost
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TryGhost",
"product": "Ghost",
"versions": [
{
"status": "affected",
"version": "4.39.0",
"lessThan": "6.64.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.64.0",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/ghost",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104416
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8999 · Revision 1
- Added to Heist Feed
- Publisher date