CVE-2026-104412 TryGhost CVE debrief

Who should care

Defenders responsible for Ghost installations should assess exposure and prioritize updating to version 6.64.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and update vulnerable Ghost installations to prevent role escalation. Monitoring for suspicious activity is recommended to detect potential unauthorized access. Reviewing user roles and permissions is also crucial to防止滥

Why it matters

CVE-2026-104412 is a role escalation vulnerability in Ghost that allows editors to promote staff users to their own role. Defenders should prioritize updating Ghost to version 6.64.0 or later to prevent role escalation.

• Role escalation could lead to unauthorized access
• Defenders need to verify and update vulnerable Ghost installations
• Monitoring for suspicious activity is recommended

Technical summary

The vulnerability existed in Ghost from version 0.5.0 up to version 6.64.0. Staff users with Editor or Super Editor roles could assign their own role to Author and Contributor users. The issue was fixed in version 6.64.0. This role escalation vulnerability could lead to unauthorized access and defenders should prioritize updating Ghost to version 6.64.0 or later to prevent role escalation. The vulnerability was responsibly disclosed by SecBuddyF of Tencent KeenLab, Santosh Kumar Puppala, Pedro Pinho, and Nhat Anh Vu.

Defensive priority

Defenders should prioritize updating Ghost to version 6.64.0 or later to prevent role escalation.

Recommended defensive actions

• Update Ghost to version 6.64.0 or later
• Review user roles and permissions
• Monitor for suspicious activity
• Verify and update vulnerable Ghost installations
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allowed staff users with Editor or Super Editor roles to assign their own role to Author and Contributor users. The issue was responsibly disclosed by SecBuddyF of Tencent KeenLab, Santosh Kumar Puppala, Pedro Pinho, and Nhat Anh Vu.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.