CVE-2026-104416
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API…
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
- Affected
- See advisory
- Fix
- Upgrade the product to 6.64.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
References
Original description
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
Last activity 2 Oct 2026. Patch Forecast updates every hour.