CVE-2026-104412: Ghost Package Allows Editors to Elevate User Roles Improperly
Summary
CVE-2026-104412: Ghost: Editors Could Promote Staff Users to Their Own Role. Affects ghost versions >= 0.5.0, < 6.64.0. Fixed in 6.64.0. How to fix ↓
Also tracked for
The same CVE-2026-104412 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It provides a user-friendly interface for bloggers and publishers, allowing them to easily create, edit, and manage their posts. The platform supports various user roles, including Admin, Editor, Author, and Contributor, each with specific permissions. However, a recent vulnerability has been identified that allows users with Editor or Super Editor roles to improperly assign their own role to lower-level users, potentially compromising the integrity of user permissions.
Vulnerability Detail
The vulnerability arises from a flaw in the role assignment logic within Ghost, specifically affecting versions from v0.5.0 up to v6.64.0. Staff users with the Editor or Super Editor role were able to assign their own roles to Author and Contributor users without having the necessary permissions. This could lead to unauthorized access and control over content management, allowing lower-level users to gain elevated privileges and potentially manipulate the platform inappropriately.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.64.0
This is the first release that contains the fix.
npm install ghost@6.64.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the Editor and Super Editor roles until the update can be applied. Regularly review user permissions to ensure that only authorized personnel have elevated roles.
Conclusion
The vulnerability identified as CVE-2026-104412 in the Ghost package allows unauthorized role assignments, posing a risk to content management integrity. It is crucial for users to update to version 6.64.0 or later to mitigate this risk. Regular monitoring of user roles and permissions is also recommended.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows Editors and Super Editors to improperly assign their roles to lower-level users, potentially compromising the security and integrity of the content management system.
You can check your Ghost version by accessing the admin panel or using the command line. If your version is between 0.5.0 and 6.64.0, it is affected.
If immediate updating is not possible, restrict access to the Editor and Super Editor roles and monitor user permissions closely.
More information can be found in the Ghost security advisory or by contacting Ghost support at security@ghost.org.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
