CVE-2026-103267

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103267

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103267.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103267

Aliases

GHSA-xcgh-2828-cvmx

Published

2026-10-01T10:42:08Z

Modified

2026-10-03T03:45:45Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Details

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-807"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103267.json"
}

References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type

GIT

Repo

https://github.com/tryghost/ghost

Events

Introduced

3478aa3a926ed8eadc9599ce9e97db0aa6fc6f70

Fixed

b88c3e120ed108002e7083ae45abaa5d31d0e1cf

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.5.0"
        },
        {
            "fixed":  "6.62.0"
        },
        {
            "introduced":  "0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103267.json"