CVE-2026-104416: Ghost Package - Invite Token Disclosure in Admin API
Summary
CVE-2026-104416: Ghost: Invite Token Disclosure in Ghost Admin API. Affects ghost versions >= 4.39.0, < 6.64.0. Fixed in 6.64.0. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-104416 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source Node.js content management system designed for professional publishing. It provides a user-friendly interface for creating and managing content, with features such as customizable themes, SEO optimization, and membership management. However, certain versions of Ghost have a vulnerability that could allow unauthorized privilege escalation through the Admin API.
Vulnerability Detail
The vulnerability exists in Ghost versions 4.39.0 to 6.64.0, where staff users with permission to view staff invites can access the secret token of pending invites. This includes invites for roles with higher privileges than their own, potentially allowing these users to escalate their privileges by accepting a pending invite. The issue arises from insufficient access controls in the Admin API, which exposes sensitive information to unauthorized users.
How To Fix
Minimum fixed version
6.64.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Admin API for staff users who do not require permission to view staff invites. This can be done by adjusting user roles and permissions within the Ghost admin settings.
Conclusion
The Ghost CMS vulnerability CVE-2026-104416 poses a significant risk by allowing unauthorized privilege escalation through the Admin API. It is crucial for users of affected versions to update to 6.64.0 or later to mitigate this risk. Implementing access restrictions can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows unauthorized staff users to escalate their privileges by accepting pending invites, potentially compromising the security of the Ghost installation.
Ghost versions from 4.39.0 to 6.64.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, the issue has been fixed in Ghost version 6.64.0. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, consider restricting access to the Admin API for users who do not need to view staff invites as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
