# CVE-2026-103267: Ghost authentication bypass in staff invite acceptance

Source: https://junglewise.ai/threats/cve-2026-103267-ghost-versions-before-6-62-0-contain-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103267 · Severity: medium · CVSS 4.3 · Published 2026-10-01

Ghost is a blogging and content management platform. A vulnerability in how staff invites are accepted allows an attacker to create an account with any email address, even if they lack a legitimate invite token or the token belongs to someone else. This could enable account takeover, impersonation, or unauthorized staff access.

Technologies: [Ghost](https://junglewise.ai/threats/technologies/ghost-ghost). Vendors: [Ghost](https://junglewise.ai/threats/vendors/ghost).

## Quick answers

**Is CVE-2026-103267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103267 being exploited in the wild.

**How severe is CVE-2026-103267?** Medium severity, with a CVSS score of 4.3, published 1 October 2026.

**Which products and versions are affected?** Ghost 0.5.0 to 6.61.x.

**Is there a fix for CVE-2026-103267?** Yes: fixed in 6.62.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103267 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103267?** Check whether you run Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.62.0

## Technical details

Staff invite acceptance in Ghost did not validate the email address submitted during account creation against the invite token, allowing attackers to accept leaked invite tokens with attacker-controlled email addresses (CWE-807). The attack requires a valid but leaked invite token and network access to the invite endpoint; no user interaction is needed once a token is obtained. An attacker gains the ability to create a staff account with arbitrary email, enabling unauthorized access to administrative functions.

## Affected products

- Ghost Ghost 0.5.0 to 6.61.x

## Timeline

- 2026-09-03: disclosed
- 2026-10-01: advisory

## References

- [https://github.com/TryGhost/Ghost/security/advisories/GHSA-xcgh-2828-cvmx](https://github.com/TryGhost/Ghost/security/advisories/GHSA-xcgh-2828-cvmx)
- [https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.62.0-arbitrary-email-registration-via-staff-invite](https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.62.0-arbitrary-email-registration-via-staff-invite)

## Related threats

- [Ghost input validation bypass in comments access control](https://junglewise.ai/threats/cve-2026-105681-ghost-is-a-node-js-content-management-system-from-5-9-0-until-6)
- [Ghost privilege escalation via user role assignment](https://junglewise.ai/threats/cve-2026-105678-ghost-is-a-node-js-content-management-system-from-0-5-0-until-6)
- [Ghost arbitrary code execution in theme translation loading](https://junglewise.ai/threats/cve-2026-105677-ghost-is-a-node-js-content-management-system-from-6-10-3-until-6)
- [Ghost privilege escalation via staff invite token disclosure](https://junglewise.ai/threats/cve-2026-105675-ghost-is-a-node-js-content-management-system-from-4-39-0-until-6)
- [Ghost CMS arbitrary file storage in bookmark cards](https://junglewise.ai/threats/cve-2026-105651-ghost-is-a-node-js-content-management-system-from-5-94-0-until-6)