BIT-ghost-2026-105678

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105678.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-ghost-2026-105678
Aliases
Published
2026-10-13T06:50:29Z
Modified
2026-10-13T08:26:08Z
Summary
Ghost: Editors Could Promote Staff Users to Their Own Role
Details

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / ghost

Package

Name
ghost
Purl
pkg:bitnami/ghost

Severity

  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0.5.0
Fixed
6.64.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105678.json"