CVE-2026-103267: Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-807

Description

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

Affected products

TryGhost Ghost: from 0.5.0 before 6.62.0 — fixed in 6.62.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.62.0. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-xcgh-2828-cvmx
https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.62.0-arbitrary-email-registration-via-staff-invite

Get alerted when CVE-2026-103267 or the next vulnerability affects your stack