CVE-2026-105678: Ghost CMS Authorization Bypass Vulnerability

CVE-2026-105678 Overview

Ghost is a Node.js content management system used for publishing and blogging. CVE-2026-105678 is an improper privilege management flaw [CWE-269] affecting Ghost versions from 0.5.0 up to 6.64.0. Staff users holding the Editor or Super Editor role can assign their own role to Author and Contributor users, despite lacking permission to grant that role. The issue violates the intended role hierarchy enforcement in the user model. The maintainers resolved the flaw in version 6.64.0.

Critical Impact
Editor and Super Editor staff accounts can escalate the privileges of lower-tier Author or Contributor users to match their own role, undermining the Ghost role hierarchy and expanding content modification rights beyond intended boundaries.

Affected Products

Ghost (Node.js CMS) versions 0.5.0 through 6.63.x
Deployments using the Editor role for staff accounts
Deployments using the Super Editor role for staff accounts

Discovery Timeline

2026-10-05 - CVE-2026-105678 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105678

Vulnerability Analysis

The flaw resides in the user model role-assignment logic within ghost/core/core/server/models/user.js. When a staff user edited another user's profile, the permission check only compared the requested role to the acting user's own role. If the two roles matched, the write proceeded without invoking the canThis assignment check. An Editor editing an Author could therefore promote that Author to Editor, because the role being assigned equals the actor's role. The role hierarchy explicitly disallows Editors from granting the Editor role to anyone.

The vulnerability requires authenticated access with Editor or Super Editor privileges. Impact is limited to integrity of the staff role assignments. Confidentiality and availability are not directly affected.

Root Cause

The conditional branch roleId !== contextRoleId short-circuited the permission check whenever the target role equalled the acting user's role. The code failed to distinguish between a self-edit, where the user updates their own profile, and an edit targeting another user. As a result, the assign permission check was skipped for cross-user role writes that happened to echo the actor's role.

Attack Vector

An authenticated Editor or Super Editor sends an API request to update an Author or Contributor user record. The request body includes a roles array containing the actor's own role identifier. The server accepts the update and persists the elevated role on the target account.

javascript

                 }),
               );
             }
-          } else if (roleId !== contextRoleId) {
+          } else if (roleId !== contextRoleId || editedUserId !== context.user) {
             // CASE: you are trying to change a role, but you are not owner
-            // @NOTE: your role is not the same than the role you try to change (!)
-            // e.g. admin can assign admin role to a user, but not owner
+            // @NOTE: assigning any role to *another* user must always go through
+            // the assign check, including your own role. Otherwise an Editor could
+            // promote an Author to Editor, which the role hierarchy disallows.
+            // The only case that skips the check is a self-edit that leaves your
+            // own role untouched, e.g. a profile update that echoes back `roles`.

             return permissions
               .canThis(context)

Source: Ghost commit 99c5642. The patch adds the editedUserId !== context.user clause so any cross-user role write passes through the canThis assignment check.

Detection Methods for CVE-2026-105678

Indicators of Compromise

Audit log entries showing an Author or Contributor account whose role was changed to Editor or Super Editor by a non-Owner, non-Administrator user.
PUT /ghost/api/admin/users/:id/ requests with a roles payload originating from an Editor or Super Editor session.
Unexpected growth in the Editor or Super Editor staff count compared to the organization's baseline roster.

Detection Strategies

Query the Ghost database roles_users table for role changes applied to users previously assigned Author or Contributor roles.
Review Ghost Admin API access logs for staff users invoking the user-edit endpoint against accounts other than their own.
Correlate role-change events with the acting user's role at the time of the request to identify out-of-policy promotions.

Monitoring Recommendations

Alert when any role assignment to Editor or Super Editor is performed by an account that does not hold the Owner or Administrator role.
Enable staff activity logging and forward Ghost application logs to a centralized log store for retention and query.
Periodically reconcile the staff user list against an authoritative source such as HR or identity provider records.

How to Mitigate CVE-2026-105678

Immediate Actions Required

Upgrade Ghost to version 6.64.0 or later on all production and staging instances.
Audit the current staff user list and revert any unauthorized role promotions discovered through log review.
Rotate session tokens and API keys for any staff accounts suspected of abusing the flaw.

Patch Information

The fix is included in Ghost 6.64.0, released on GitHub as Ghost v6.64.0. The code change is tracked in issue #30764 and documented in GHSA-4pvx-fwjj-8gpc. The patch commit 99c5642 requires the assignment permission check for any edit targeting another user.

Workarounds

Temporarily restrict Editor and Super Editor assignments to trusted personnel until upgrading.
Limit administrative API access to known IP ranges using a reverse proxy or web application firewall.
Downgrade affected staff users to lower-privilege roles if upgrading cannot be scheduled immediately.

bash

# Upgrade Ghost using the Ghost-CLI
ghost update 6.64.0

# Verify installed version
ghost version