CVE-2026-105678: Ghost: Editors Could Promote Staff Users to Their Own Role
Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.
References
- github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf
- github.com/TryGhost/Ghost/issues/30764
- github.com/TryGhost/Ghost/pull/30764
- github.com/TryGhost/Ghost/releases/tag/v6.64.0
- github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc
- github.com/advisories/GHSA-4pvx-fwjj-8gpc
- nvd.nist.gov/vuln/detail/CVE-2026-105678
Code Behaviors & Features
Detect and mitigate CVE-2026-105678 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →