CVE-2026-105678

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105678
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105678.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105678
Aliases
Published
2026-10-05T19:20:36Z
Modified
2026-10-07T02:45:57Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Ghost: Editors Could Promote Staff Users to Their Own Role
Details

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105678.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
3478aa3a926ed8eadc9599ce9e97db0aa6fc6f70
Fixed
99c5642b9bb481df4811a004a6f19d6143ed9aaf
Fixed
2fa451a7dca010016608065ad33bcc58c0043070
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.5.0"
        },
        {
            "fixed": "6.64.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105678.json"