Staff Token Permission Bypass in Ghost Package
Summary
GHSA-9xg7-mwmp-xmjx: Ghost has Staff Token permission bypass. Affects ghost across 2 version ranges.
>= 5.105.0, < 5.130.6
>= 6.0.0, < 6.11.0
Fixed in 5.130.6 or 6.11.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It provides a user-friendly interface for bloggers and publishers, allowing them to easily manage posts, pages, and other content types. The platform supports various themes and plugins, making it highly customizable. However, a recent vulnerability has been identified that affects its authentication mechanism, specifically regarding Staff Tokens, which are used for user authentication in administrative roles.
Vulnerability Detail
A vulnerability in Ghost's handling of Staff Token authentication has been discovered, allowing unauthorized access to certain endpoints that should only be accessible through Staff Session authentication. This flaw could enable external systems authenticated via Staff Tokens for Admin or Owner roles to access sensitive endpoints, potentially leading to unauthorized actions and data exposure.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.105.0, < 5.130.65.130.6npm install ghost@5.130.6 -
>= 6.0.0, < 6.11.06.11.0npm install ghost@6.11.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to limit the use of Staff Tokens and ensure that only trusted systems have access to them until the package can be updated to a secure version.
Conclusion
The Ghost package has a critical vulnerability related to Staff Token authentication that allows unauthorized access to sensitive endpoints. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ghost →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
The vulnerability affects Ghost versions from 5.121.0 to 5.130.5 and from 6.0.0 to 6.10.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The vulnerability was discovered and responsibly disclosed by Sho Odagiri of GMO Cybersecurity by Ierae, Inc.
If immediate updates are not possible, consider limiting the use of Staff Tokens and restricting access to trusted systems until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
