{"schemaVersion":3,"id":"CVE-2026-105678","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.","dates":{"published":"2026-10-05T19:20:36.210Z","modified":"2026-10-07T21:44:35.429Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00196,"percentile":0.08748,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-06T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00196,"percentile":0.08748}],"last30":[{"date":"2026-10-06T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00196,"percentile":0.08748}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/269.html"},{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"tryghost","product":"ghost","name":"Ghost","label":"ghost","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.5.0, < 6.64.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.5.0, < 6.64.0","eol":null,"hubHref":"/vendor/tryghost/ghost"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc","label":"github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc","hostname":"github.com","tags":["X Refsource CONFIRM"]},{"url":"https://github.com/TryGhost/Ghost/issues/30764","label":"github.com/TryGhost/Ghost/issues/30764","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf","label":"github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","label":"github.com/TryGhost/Ghost/releases/tag/v6.64.0","hostname":"github.com","tags":["X Refsource MISC"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-05T19:20:36.210Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-07T21:44:35.429Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":17,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:47:55.936Z","stale":false,"partial":false}}