Back github.com

GHSA V6q3 Xqxm 6f5v

github.com • October 3, 2026

Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite.

This vulnerability is present in Ghost from v4.39.0 up to v6.64.0.

v6.64.0 contains a fix for this issue.

For self-hosters using Docker, find Docker's official Ghost image here . Updating a Docker-based Ghost instance is documented here .

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here .

We thank CoryRoo , Pedro Pinho, and Nhat Anh Vu for disclosing this vulnerability responsibly.

If you have any questions or this advisory, email us at [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghost CMS Vulnerabilities: Privilege Escalation and 2FA Bypass Two vulnerabilities affecting Ghost CMS have been disclosed. The first, identified as GHSA-v6q3-xqxm-6f5v, allows staff users to discover secret tokens for pending invites, enabling privilege escalation. This affects versions from v4.39.0 to v6.64.0, with a fix in v6.64.0. The second vulnerability, GHSA-q55r-w7fh-rmh6, permits any authenticated staff user to log in as another staff user by bypassing two-factor authentication, impacting versions from v6.20.0 to v6.57.1, with a patch in v6.57.1. Both vulnerabilities were disclosed responsibly by researchers and are for self-hosted instances of Ghost CMS. Users are advised to update their installations promptly to mitigate risks. 58

Extracted Entities

GHSA V6q3 Xqxm 6f5v

The full story

Extracted Entities

CWE Weaknesses (2)

Domains (1)

Email Addresses (1)

MITRE ATT&CK (1)

Ransomware Groups (1)

Tools (1)