CVE-2026-105675 · GHSA-v6q3-xqxm-6f5v
Ghost: Invite Token Disclosure in Ghost Admin API
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting…
- Affected
- ghost (npm) >= 4.39.0, < 6.64.0
- Fix
- Upgrade ghost to 6.64.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…
The flaws
- CVE-2026-105675: Ghost: Invite Token Disclosure in Ghost Admin API (CVSS 7.5 · EPSS 0%)
- CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
- CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
- CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)
The fix
Upgrade ghost: 6.64.0 · 6.67.0 or later on your release line
Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-203 (CWE-203). 9 other warnings in 30 days
Why it is Yellow
- CVSS 7.5 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| ghost | npm | >= 4.39.0, < 6.64.0 | 6.64.0 |
References
- https://github.com/advisories/GHSA-v6q3-xqxm-6f5v
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v
- https://nvd.nist.gov/vuln/detail/CVE-2026-105675
- https://github.com/TryGhost/Ghost/pull/30760
- https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
- https://github.com/advisories/GHSA-v6q3-xqxm-6f5v
Original description
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.