CVE-2026-104412 Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
Authenticated Editors can improperly promote Authors to Editor roles, allowing unauthorized privilege escalation within the Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104412?
CVE-2026-104412 is a medium-severity vulnerability in TryGhost Ghost, published on 2 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
Weakness: CWE-269
Which versions are affected by CVE-2026-104412?
How do I fix CVE-2026-104412?
Upgrade to a fixed version.
Is CVE-2026-104412 being exploited?
There is no known exploitation of CVE-2026-104412 in the wild and no public exploit code.
Sources
Also known as GHSA-g74c-47mq-8gfq, MINI-q3v9-9qrf-qjf5.