CVE-2026-103268

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103268
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103268.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103268
Aliases
Downstream
Published
2026-10-01T10:42:09Z
Modified
2026-10-21T02:54:30Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
Details

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103268.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
0629791824d271053f5656cfdd075d5e302ccda3
Fixed
b88c3e120ed108002e7083ae45abaa5d31d0e1cf
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "6.62.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "6.62.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103268.json"