CVE-2026-103267: Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.62.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid staff invite token, such as one obtained from a leaked invitation. A legitimate invite recipient can also trigger the issue by registering with an unintended email provider.
What is the practical impact of a leaked invite token?
A leaked token can be accepted using an attacker-controlled email address, allowing the attacker to create an account through the staff invite flow. The provided information indicates integrity impact but does not describe confidentiality or availability impact.
Which versions should be remediated?
Ghost versions from 0.5.0 before 6.62.0 are affected. Upgrade to 6.62.0 or later.