CVE-2026-103282 — Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite toke…
Published: 2026-10-01 · CVSS: 5.3 · CVSS 4.0
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7