Skip to content
OpenAdvisories
High · 7.3 CVE-2026-103286 EUVD-2026-90679GHSA-wmw5-238j-rqvj

Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

Published Oct 1, 2026 · Updated Oct 1, 2026 · Assigned by VulnCheck

Description

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated privileges without proper authorization checks.

Affected products

VendorProductAffectedFixed
TryGhost Ghost 2.21.0 – < 6.56.0 6.56.0

References