Ghost CMS CVE-2026-103273

Requires a valid, already-provisioned low-privilege Ghost staff account (PR:L) - e.g. Author or Contributor roles - on an instance running Ghost 4.3.0 through 6.57.x. The attacker leverages staff tokens to send post-editing API requests that exceed their assigned role's permissions. No user interaction is needed (UI:N) and the vector is network-reachable, but exploitation is gated by holding staff credentials; it is not reachable by anonymous/unauthenticated internet users. Impact is limited to unauthorized modification of post content (integrity), with no disclosure or availability effect.

This is a moderate, authenticated-only authorization flaw - not a widespread-exploitation priority. The CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach with low complexity but requires existing low-privilege staff credentials (PR:L), and impact is confined to integrity (VI:L) with no confidentiality or availability effect - consistent with CWE-863 (incorrect authorization). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is insider/privilege-boundary abuse within an organization's own staff, not mass internet-facing compromise. The input label 'Authentication Bypass' overstates the nature of the issue: the CWE (863) and description describe an authenticated staff user exceeding their authorization, not bypassing authentication - this mislabeling should not be read as a login-bypass. Overall a real but low-urgency issue; patch during normal maintenance.

A legitimately provisioned low-privilege Ghost staff account (e.g. Author or Contributor) obtains or reuses a valid staff token and issues API requests to edit posts the account should not be permitted to modify, exceeding its assigned editorial privilege. No public exploit code is referenced, and exploitation requires already holding valid staff credentials on the instance.