CVE-2026-104416: Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Q: Who can exploit this issue?

A staff user who has permission to view pending staff invites can exploit it. The issue is not described as exploitable by an unauthenticated attacker.

Q: What is required for privilege escalation?

There must be a pending staff invite for a higher-privileged role. An eligible staff user can view that invite's secret token through the Admin API and accept the invite to obtain the higher role.

Q: Which deployments are affected?

Ghost versions from 4.39.0 before 6.64.0 are affected. Exposure depends on having staff users with invite-viewing permission and pending invites for roles with greater privileges.

Q: How can administrators assess whether they may already be exposed?

Review whether the Ghost instance is running a version from 4.39.0 through versions earlier than 6.64.0. Also review pending staff invitations, especially higher-privileged invitations, and identify staff accounts permitted to view invites.

Published Oct 2, 2026

Updated

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.

Affected Software

1 affected component

Ghost Ghost>=4.39.0<6.64.0

Event History

Oct 2, 2026

CVE Published

via MITRE·11:37 AM

Data Sourced

via MITRE·11:37 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A staff user who has permission to view pending staff invites can exploit it. The issue is not described as exploitable by an unauthenticated attacker.

What is required for privilege escalation?

There must be a pending staff invite for a higher-privileged role. An eligible staff user can view that invite's secret token through the Admin API and accept the invite to obtain the higher role.

Which deployments are affected?

Ghost versions from 4.39.0 before 6.64.0 are affected. Exposure depends on having staff users with invite-viewing permission and pending invites for roles with greater privileges.

How can administrators assess whether they may already be exposed?

Review whether the Ghost instance is running a version from 4.39.0 through versions earlier than 6.64.0. Also review pending staff invitations, especially higher-privileged invitations, and identify staff accounts permitted to view invites.

CVE-2026-104416: Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required for privilege escalation?

Which deployments are affected?

How can administrators assess whether they may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required for privilege escalation?

Which deployments are affected?

How can administrators assess whether they may already be exposed?