Ghost CMS CVE-2026-105678

Requires an authenticated staff account with the Editor or Super Editor role on a Ghost instance running between 0.5.0 and 6.63.x (fixed in 6.64.0), plus the existence of target Author or Contributor accounts to promote. Exploitation is performed through the Ghost Admin API user-update (PUT users/:id) endpoint by echoing the attacker's own Editor role onto another user. Limiting factors: the attacker must already hold Editor-level trust (not a remote outsider), user interaction is not needed, and the escalation is bounded - only the attacker's own (Editor) role can be assigned, so Author/Contributor targets cannot be pushed to Administrator or Owner. A legitimate self-edit that echoes back an unchanged role is explicitly not affected.

This is a CVSS 4.3 (Medium) privilege-escalation flaw (CWE-269) whose signals consistently point to modest, insider-dependent risk rather than an urgent priority. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N requires an already-authenticated low-privileged actor (PR:L) - specifically a staff user holding the Editor or Super Editor role - so this is not a remote unauthenticated compromise. Impact is integrity-only and limited (I:L, C:N, A:N, S:U): the attacker can grant the Editor role to Author/Contributor accounts but cannot reach Administrator or Owner, bounding the escalation to the Editor tier. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit was identified - the only code artifact is the vendor fix commit, which is a patch, not a proof-of-concept. All signals align (low CVSS, no KEV, no POC, authenticated-only, limited integrity impact), with no conflicts to flag; the main missing datum is EPSS. Net: treat as a routine insider/authorization hardening fix, prioritized by how many semi-trusted Editor accounts exist, not as an emergency.

A malicious or compromised Ghost staff user holding the Editor (or Super Editor) role sends a crafted user-update request to the Admin API assigning the Editor role to an Author or Contributor account they influence, bypassing the role-hierarchy check that should forbid editors from granting the editor role. This elevates lower-privileged accounts to Editor despite the attacker lacking permission to assign that role. No public exploit exists, but the vendor fix commit (99c5642) discloses the exact faulty authorization branch.