Ghost, a Node.js content management system, contained a flaw that allowed staff users with Editor or Super Editor permissions to elevate other users to the same elevated role. The vulnerability enabled an authorized editor to repeatedly assign the Editor role to Author and Contributor accounts, thereby granting those users higher authority without proper authorization. This issue is a classic privilege‑escalation weakness, classified as CWE-269 and CWE-863, exposing the system to potential abuse of editorial control, unauthorized content modifications, or policy violations.

The flaw affected Ghost releases from version 0.5.0 through 6.64.0, released by TryGhost. Any instance running a version in this range is vulnerable.

The CVSS score is 4.3, indicating medium severity, and the EPSS score is not available, meaning no recent exploitation data is reported. The vulnerability is listed as not in the CISA KEV catalog. Based on the description, the likely attack vector is local or within the defined user role boundaries rather than external remote exploitation, and requires the attacker to already possess Editor or Super Editor privileges to use the flaw.