CVE-2026-103282: Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-362

Description

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.

Affected products

TryGhost Ghost: from 0.5.0 before 6.23.0 — fixed in 6.23.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.23.0. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-vf9h-87xm-g767
https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.23.0-multiple-account-creation-via-invite-token

Get alerted when CVE-2026-103282 or the next vulnerability affects your stack