CVE-2026-103267 — Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account…
Published: 2026-10-01 · CVSS: 5.3 · CVSS 4.0
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7