CVE-2026-104412

Ghost versions 0.5.0 before 6.64.0 are vulnerable to a privilege escalation flaw due to improper restrictions on staff role assignments. An authenticated user with an Editor or Super Editor role can bypass permission checks to assign their own role to other staff members. Specifically, these user...