Ghost: Authentication bypass via password reset for suspended staff accounts

Summary

Ghost versions from 1.0.0 before 6.62.0 allow a suspended staff user to reactivate their own account through the self-service password reset. An attacker holding valid credentials of a suspended staff account can use this to regain active access and restore the original staff privileges. The attack requires low privileges (suspended account credentials) and the Ghost Admin login is normally reachable from the internet.

Affected

• Ghost from 1.0.0 up to and including 6.61.x (before 6.62.0)

Fixed in

• Ghost 6.62.0 and later

Workaround

• Unknown. No workaround is documented in the sources; upgrading to 6.62.0 or later is the remedy.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV according to the aggregator checked.
• In-the-wild exploitation: unknown. No reports of exploitation found.

Our recommendation

• Upgrade Ghost to version 6.62.0 or later.
• Review the staff list and remove or disable suspended and former staff accounts, and end their active sessions.
• Check suspended accounts that became active again for unexpected activity.
• Restrict Admin access and monitor staff logins until the upgrade is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-q734-xjgc-vpj9 github.com
• VulnCheck advisory: Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset www.vulncheck.com
• Ghost release v6.62.0 github.com
• OSV: CVE-2026-103268 osv.dev
• Strix: CVE-2026-103268 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:21.