CVE-2026-104416: Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A staff user who has permission to view pending staff invites can exploit it. The issue is not described as exploitable by an unauthenticated attacker.
What is required for privilege escalation?
There must be a pending staff invite for a higher-privileged role. An eligible staff user can view that invite's secret token through the Admin API and accept the invite to obtain the higher role.
Which deployments are affected?
Ghost versions from 4.39.0 before 6.64.0 are affected. Exposure depends on having staff users with invite-viewing permission and pending invites for roles with greater privileges.
How can administrators assess whether they may already be exposed?
Review whether the Ghost instance is running a version from 4.39.0 through versions earlier than 6.64.0. Also review pending staff invitations, especially higher-privileged invitations, and identify staff accounts permitted to view invites.