An authorization flaw in the Ghost content management system allows authenticated users to bypass intended access controls, creating a high risk of unauthorized administrative actions.

The vulnerability involves incorrect authorization (CWE-863) where Staff Tokens are improperly validated against endpoints requiring Staff Session authentication. This allows an attacker who already possesses a valid Staff Token for an Admin or Owner role to interact with restricted API endpoints that should be inaccessible to them.

The ability for an authenticated user to perform unauthorized actions on sensitive endpoints presents a significant risk to data integrity and system availability. With a CVSS score of 8.1, the high impact on integrity and availability indicates that attackers could potentially modify site configurations or disrupt core services. Unauthorized access to administrative functions can lead to severe reputational damage and the loss of platform control.

Immediate Action: Update the Ghost installation to version 6.11.0 or 5.130.6 immediately to apply the necessary authorization checks.

Proactive Monitoring: Review administrative audit logs for unusual API activity or unauthorized access attempts originating from authenticated Staff Token sessions.

Compensating Controls: Implement strict network-level access controls to limit access to the Ghost administrative interface to known, trusted IP addresses while the update is being prepared.

Public Exploit Available: Unknown

Given the High severity score and the potential for unauthorized administrative operations, organizations should prioritize patching Ghost instances to the specified secure versions. Ensuring that administrative tokens are managed with the principle of least privilege will further reduce the window of opportunity for this vulnerability to be weaponized by compromised accounts.