Description (CNA)
Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TryGhost / Ghost | affected 4.3.0 before 6.58.0; unaffected 6.58.0 |
CWE
CWE-863
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-jj85-wvj2-r86m
- https://www.vulncheck.com/advisories/ghost-4.3.0-before-6.58.0-incorrect-authorization-via-staff-token
ADP enrichment
No English description supplied.
No references supplied.