TL;DR

A Contributor, the role with the lowest privileges in Ghost CMS, can create an article containing attacker-controlled JavaScript executable content. When an Owner previews or views that article, the injected script executes in the Owner’s browser and changes the Owner’s account email to an attacker-controlled address. The attacker can then request a password reset magic link sent to that email, complete the reset, and gain full Owner privileges - achieving account takeover.

Local setup

• Node Version: v22.12.0
• Ghost-CLI Version: 1.28.3
• Ghost Version: 6.3.1
• Mailpit (v1.27.10)