Description
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TryGhost | Ghost | 0.5.0 – < 6.23.0 | 6.23.0 |
References
- GitHub Security Advisory (GHSA-vf9h-87xm-g767) vendor-advisory
- VulnCheck Advisory: Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token third-party-advisory