UpHeron
All vulnerabilities

Servers and applications

GHSA-8jqq-qq46-c657

Owner Role Assignment via Content Import

Severity
Medium 5.5
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
6.76.0
Weakness
Improper input validation (CWE-20)Improper privilege management (CWE-269)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read some data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Sources
Project advisories (GitHub)

Description

A user or integration allowed to import content (Administrators, their staff access tokens, and the built-in DB Backup and Self-Serve Migration integrations) could use a crafted import file to create an additional user with the Owner role. That account could not be deleted, including by the real Owner, and could be used to gain Owner-level access to the site.

The impact is a privilege escalation from Administrator to Owner and a persistent, unremovable Owner-level account.

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

From TryGhost/Ghost's security advisory.

Workarounds

Only grant the Administrator role to trusted users, and keep access to the DB Backup and Self-Serve Migration integration tokens restricted until you can update.

Workarounds as given by TryGhost/Ghost's security advisory.

Affected software

SoftwareAffected versions
GhostServers and applications · github:tryghost/ghost
  • From 1.0.0 before 6.76.0

References