{"id":"CVE-2026-104412","aliases":["BIT-ghost-2026-104412","BIT-ghost-2026-105678","EUVD-2026-91423","GHSA-4pvx-fwjj-8gpc","GHSA-g74c-47mq-8gfq"],"status":"published","title":"Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00192,"percentile":0.08979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-863"],"published":"2026-10-02T11:37:56Z","modified":"2026-10-28T02:31:13Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"6.64.0"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"6.64.0"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"6.64.0"}]}],"bundled":2}],"products":[{"vendor":"tryghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc","tags":["vendor-advisory","web","advisory"]},{"url":"https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.64.0-privilege-escalation-via-staff-role-assignment","tags":["third-party-advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104412","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g74c-47mq-8gfq"},{"url":"https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf","tags":["web","fix"]},{"url":"https://github.com/TryGhost/Ghost/issues/30764","tags":["web","report"]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105678","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104412.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105678.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost/pull/30764","tags":["web"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-104412","title":"Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","status":"published","published":"2026-10-02T11:37:56.456Z","modified":"2026-10-06T02:34:23.786Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-91423","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","status":"published","published":"2026-10-02T11:37:56Z","modified":"2026-10-06T02:34:23Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:38.724649Z"}],"ghsa":[{"id":"GHSA-g74c-47mq-8gfq","title":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with...","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","status":"published","published":"2026-10-02T12:31:13Z","modified":"2026-10-02T12:31:19Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:12:42.431145Z"}],"nvd":[{"id":"CVE-2026-104412","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","status":"published","published":"2026-10-02T12:17:10.84Z","modified":"2026-10-06T03:16:59.777Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:53.41762Z"}],"osv":[{"id":"CVE-2026-104412","title":"Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","status":"published","published":"2026-10-02T11:37:56.456Z","modified":"2026-10-28T02:31:13.444971722Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"CVE-2026-105678","title":"Ghost: Editors Could Promote Staff Users to Their Own Role","description":"Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-05T19:20:36.21Z","modified":"2026-10-28T02:30:44.394737712Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-4pvx-fwjj-8gpc","title":"Ghost: Editors Could Promote Staff Users to Their Own Role","description":"### Impact\n\nStaff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v0.5.0 up to v6.64.0.\n\n### Patches\n\nv6.64.0 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks [SecBuddyF](https://github.com/SecBuddyF) of [Tencent KeenLab](https://github.com/KeenSecurityLab), [Santosh Kumar Puppala](https://github.com/Santoshkumarpuppala), Pedro Pinho, and [Nhat Anh Vu](https://github.com/nhattanhh) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-07T20:26:03Z","modified":"2026-10-13T08:26:08.710190343Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"BIT-ghost-2026-104412","title":"Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment","description":"Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.","status":"published","published":"2026-10-09T10:45:14.152Z","modified":"2026-10-13T08:26:08.710190343Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"BIT-ghost-2026-105678","title":"Ghost: Editors Could Promote Staff Users to Their Own Role","description":"Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.","status":"published","published":"2026-10-13T06:50:29.575Z","modified":"2026-10-13T08:26:08.710190343Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}