Staff users within Ghost who could view staff invites could read the secret token of any pending invitation, even those intended for higher‑privilege roles. By accepting such a token, a staff member could elevate their own access level without proper authorization. The flaw is an information disclosure that directly facilitates privilege escalation, reflected by the CWE identifiers: information exposure and exposure of sensitive data to unauthorized users.

The vulnerability affects Ghost CMS versions from 4.39.0 through 6.64.0. Users should verify the exact installed version of TryGhost Ghost and determine whether they are within the affected range.

The CVSS score of 7.5 indicates a high severity. While EPSS data is unavailable and the issue is not listed in CISA KEV, the availability of a token to authorized staff creates a clear attack path. Attackers with legitimate staff credentials, or who compromise such an account, could obtain the token via the Admin API, accept the invite, and gain elevated privileges. The flaw is fixed in version 6.64.0. Responders should treat this as a significant risk until the patch is applied.