Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:35:58 +0000 CVE-2026-104416 — Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API https://db.gcve.eu/vuln/cve-2026-104416 <p><strong>Affected:</strong> TryGhost Ghost</p> <p>Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.</p> <p><strong>Affected:</strong> TryGhost Ghost</p> <p>Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.</p> https://db.gcve.eu/vuln/cve-2026-104416