high8.8
CVE-2026-103268
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service…
Impact
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges.
Affected products
| Product | Affected versions |
|---|---|
| Ghost | before 6.62.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.