CVE-2026-103288 json
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
published 2026-10-01 39 d ago modified 2026-10-27 12 d ago also BIT-ghost-2026-103288 , EUVD-2026-90681 , GHSA-qrh6-cwg3-343x
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.
Patch / fix
- npm ghost 6.44.1
- bitnami ghost 6.44.1
- TryGhost Ghost 6.44.1
- github.com/TryGhost/Ghost@405c262 commit
- github.com/TryGhost/Ghost#28297 pull request
- github.com/TryGhost/Ghost/releases/tag/v6.44.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 38 d ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ghost | >=5.9.0, <6.44.1 |
6.44.1 |
| bitnami | ghost | >=5.9.0, <6.44.1 |
6.44.1 |
Affected products
- TryGhost Ghost
Classification
References
-
github.com
/TryGhost/Ghost/pull/28297
web
-
github.com
/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
web
-
github.com
/TryGhost/Ghost/security/advisories/GHSA-qrh6-cwg3-343x
vendor-advisory, web
-
vulncheck.com
/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comment-like
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-103288
advisory, web
-
github.com
/TryGhost/Ghost
package
-
github.com
/TryGhost/Ghost/releases/tag/v6.44.1
web
Sources
- CVE List CVE-2026-103288
- GitHub Advisory GHSA-qrh6-cwg3-343x
- NVD CVE-2026-103288
- OSV BIT-ghost-2026-103288
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.