CVE-2026-103266— Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Quick assessment
Affected
TryGhost Ghost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghost 5.2.0 至 6.62.0 之前的版本存在一个漏洞，允许未经身份验证的远程攻击者滥用 Stripe Checkout（Stripe 结账）流程，将付费订阅关联到现有会员账户上，修改该会员的姓名，并向发送给该会员的新闻通讯中注入内容。根据收件人使用的邮件客户端不同，被注入的内容可能会被渲染执行，从而导致 HTML 注入或跨站脚本攻击（XSS）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103266
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Source: CVE Program / CVE List V5
Vulnerability Description
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103266
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103266
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103266 (2)
Same Patch Batch · TryGhost · 2026-10-01 · 26 CVEs total
| CVE-2026-103268 | 8.8 HIGH | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset |
| CVE-2026-103283 | 8.1 HIGH | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling |
| CVE-2026-103277 | 8.1 HIGH | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed |
| CVE-2026-103292 | 8.0 HIGH | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head |
| CVE-2026-103271 | 7.5 HIGH | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass |
| CVE-2026-103272 | 7.5 HIGH | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API |
| CVE-2026-103286 | 7.3 HIGH | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications |
| CVE-2026-103278 | 7.3 HIGH | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe |
| CVE-2026-103279 | 6.8 MEDIUM | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass |
| CVE-2026-103288 | 6.5 MEDIUM | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like |
| CVE-2026-103289 | 6.5 MEDIUM | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments |
| CVE-2026-103291 | 6.4 MEDIUM | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch |
| CVE-2026-103281 | 5.4 MEDIUM | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API |
| CVE-2026-103274 | 5.3 MEDIUM | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read |
| CVE-2026-103280 | 5.3 MEDIUM | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint |
| CVE-2026-103269 | 5.3 MEDIUM | Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts |
| CVE-2026-103276 | 5.3 MEDIUM | Ghost before 6.20.0 File Read via URL Encoding Bypass |
| CVE-2026-103284 | 4.3 MEDIUM | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback |
| CVE-2026-103282 | 4.3 MEDIUM | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token |
| CVE-2026-103275 | 4.3 MEDIUM | Ghost 5.42.2 before 6.58.0 Password Hash Disclosure |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Ghost
-
CVE-2026-103291
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch -
CVE-2026-103292
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_hea -
CVE-2026-103290
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize -
CVE-2026-103289
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments -
CVE-2026-103288
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment L
Same vendor: TryGhost
-
CVE-2026-103291
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch -
CVE-2026-103292
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_hea -
CVE-2026-103290
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize -
CVE-2026-103288
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment L -
CVE-2026-103289
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
Same weakness: CWE-863
-
CVE-2026-103758
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-con -
CVE-2026-103284
Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedb -
CVE-2026-103273
Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff -
CVE-2026-103271
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass -
CVE-2026-103265
Fleet before 4.89.0 Information Disclosure via MDM Command R
V. Comments for CVE-2026-103266
No comments yet