CVE-2026-103282 Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
Attackers can exploit a race condition in Ghost's invitation system to create multiple user accounts from a single invite token, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103282?
CVE-2026-103282 is a medium-severity vulnerability in TryGhost Ghost, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.
Weakness: CWE-362
Which versions are affected by CVE-2026-103282?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 0.5.0 | 6.23.0 |
How do I fix CVE-2026-103282?
Upgrade ghost to 6.23.0 or later.
Is CVE-2026-103282 being exploited?
There is no known exploitation of CVE-2026-103282 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103282, GHSA-fgrp-x4pm-v894, GHSA-vf9h-87xm-g767.