CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-25)

CWEs

CWE-269, CWE-863

Published

2026-10-05

Modified

2026-10-07

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf
• https://github.com/TryGhost/Ghost/issues/30764
• https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc

Check your stackJSON