---
id: CVE-2026-103267
title: >-
  Ghost versions before 6.62.0 contain an authentication bypass vulnerability in
  staff invite acceptance that allows users to specify any email address when
  creating their account
summary: >-
  Ghost versions before 6.62.0 contain an authentication bypass vulnerability in
  staff invite acceptance that allows users to specify any email address when
  creating their account. Attackers can accept leaked invite tokens with
  attacker-co…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-807
vendor: TryGhost
product: Ghost
affected:
  - Ghost >= 0.5.0 < 6.62.0
published: '2026-10-01'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T11:17:21.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103267'
references:
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-xcgh-2828-cvmx'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.62.0-arbitrary-email-registration-via-staff-invite
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-01T11:42:53.807Z'
---

## Overview

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.