CVE-2026-103289 json
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
published 2026-10-01 38 d ago modified 2026-10-13 27 d ago also BIT-ghost-2026-103289 , BIT-ghost-2026-105681 , CVE-2026-105681 , EUVD-2026-90682 , GHSA-6q6j-f24j-p477
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.
Patch / fix
- npm ghost 6.44.1
- bitnami ghost 6.44.1
- TryGhost Ghost 6.44.1
- github.com/TryGhost/Ghost@405c262 commit
- github.com/TryGhost/Ghost#28297 pull request
- github.com/TryGhost/Ghost/releases/tag/v6.44.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 38 d ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ghost | >=5.9.0, <6.44.1 |
6.44.1 |
| bitnami | ghost | >=5.9.0, <6.44.1 |
6.44.1 |
Affected products
- TryGhost Ghost
Classification
- Weakness
-
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
References
-
github.com
/TryGhost/Ghost/pull/28297
web
-
github.com
/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
web
-
github.com
/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477
vendor-advisory, web
-
vulncheck.com
/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-105681
advisory, web
-
github.com
/TryGhost/Ghost
package
-
github.com
/TryGhost/Ghost/releases/tag/v6.44.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-103289
web
Sources
- CVE List CVE-2026-103289
- GitHub Advisory GHSA-6q6j-f24j-p477
- NVD CVE-2026-103289
- OSV BIT-ghost-2026-103289
- OSV BIT-ghost-2026-105681
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.