Is CVE-2026-105678 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105678 being exploited in the wild.

How severe is CVE-2026-105678?

Medium severity, with a CVSS score of 4.3, published 2 October 2026.

Which products and versions are affected?

ghost (npm) SEMVER:introduced=0.5.0,fixed=6.64.0; TryGhost Ghost 0.5.0 before 6.64.0.

Is there a fix for CVE-2026-105678?

Yes. ghost (npm): upgrade to 6.64.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105678 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105678?

Check whether you run ghost (npm) or TryGhost Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105678: Ghost staff role assignment privilege escalation

CVE-2026-105678 · Severity: medium · CVSS 4.3 · Published 2026-10-02

Ghost is a blogging platform that manages user roles and permissions for content editors. Editors and Super Editors with limited permissions can illegally promote themselves and other staff members to higher roles, potentially giving lower-ranked users unintended administrative access. This allows role-based access controls to be bypassed by authenticated users already inside the system.

Technologies: ghost (npm), TryGhost Ghost. Vendors: npm, TryGhost.

Quick answers

Is CVE-2026-105678 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105678 being exploited in the wild.
How severe is CVE-2026-105678?: Medium severity, with a CVSS score of 4.3, published 2 October 2026.
Which products and versions are affected?: ghost (npm) SEMVER:introduced=0.5.0,fixed=6.64.0; TryGhost Ghost 0.5.0 before 6.64.0.
Is there a fix for CVE-2026-105678?: Yes. ghost (npm): upgrade to 6.64.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105678 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105678?: Check whether you run ghost (npm) or TryGhost Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ghost (npm): upgrade to 6.64.0 or later
```
npm install ghost@6.64.0
```

Technical details

An improper privilege management flaw allows Editor and Super Editor roles to invoke staff role assignment operations on Author and Contributor users, promoting them to Editor or Super Editor despite lacking authorization to do so. The vulnerability requires authentication with Editor or Super Editor privileges and network access to Ghost. A successful exploit results in unauthorized privilege escalation with no user interaction needed.

Affected products

TryGhost Ghost 0.5.0 before 6.64.0

Identifiers

CVE-2026-105678
CVE-2026-104412
GHSA-4pvx-fwjj-8gpc

Timeline

2026-09-17: disclosed
2026-10-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.