Ghost CMS EUVD-2026-91423

The attacker must already hold an authenticated Editor or Super Editor account on the target Ghost instance (PR:L) - this is the primary limiting factor and makes the flaw unexploitable by anonymous outsiders. The specific prerequisite is the staff role-assignment feature, which fails to correctly restrict which roles an Editor/Super Editor may grant; exploitation targets existing Author and Contributor accounts to elevate them to Editor or Super Editor. No user interaction from a victim is required (UI:N) and no special non-default configuration is needed - any multi-user Ghost deployment on versions 0.5.0 through before 6.64.0 is affected. Risk is inherently bounded to instances that provision Editor/Super Editor roles to parties who are not fully trusted administrators.

This is a medium-severity privilege-escalation flaw (CWE-269) with a vendor-provided CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N (score 5.3). The signals are internally consistent and point to limited real-world risk: exploitation is network-reachable and low-complexity, but requires existing authenticated access at the Editor or Super Editor level (PR:L), and the impact is confined to integrity (VI:L) with no confidentiality or availability effect and no scope change. No EPSS score was supplied in the input, and the vulnerability is NOT listed in CISA KEV; no public exploit code is referenced. Therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is insider/abuse-of-trust: a semi-privileged staff member escalating other accounts (and, by chaining, potentially themselves/peers) to higher editorial roles. This is a legitimate but moderate priority - it is not a remote-unauthenticated RCE and the high-CVSS-but-low-real-risk concern does not apply here because the CVSS is already appropriately medium. Prioritize patching on multi-author Ghost instances where not all Editors are fully trusted; deprioritize on single-admin or small trusted-team blogs.

A malicious or compromised staff member holding the Editor or Super Editor role in a shared Ghost instance uses the role-assignment functionality to promote an Author or Contributor account (which they control or collude with) to Editor or Super Editor, despite lacking the permission to grant those roles. No public exploit code is referenced; the action is performed through the application's normal staff-management interface over the authenticated network session. The result is unauthorized expansion of editorial privileges within the publication.