{"id":"CVE-2026-103288","aliases":["BIT-ghost-2026-103288","EUVD-2026-90681","GHSA-qrh6-cwg3-343x","GHSA-wj4w-mc24-pcfm"],"status":"published","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like","description":"Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00203,"percentile":0.10311,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639","CWE-943"],"published":"2026-10-01T10:42:22Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"npm","package":"ghost","fixed_in":["6.44.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"ghost","fixed_in":["6.44.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ghost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"6.44.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"5.9.0"},{"fixed":"6.44.1"}]}]},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"5.9.0"},{"fixed":"6.44.1"}]}]}],"products":[{"vendor":"tryghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-qrh6-cwg3-343x","tags":["vendor-advisory","web","advisory"]},{"url":"https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comment-like","tags":["third-party-advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103288","tags":["web","advisory"]},{"url":"https://github.com/TryGhost/Ghost/pull/28297","tags":["web"]},{"url":"https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3","tags":["web"]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.44.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qrh6-cwg3-343x"},{"url":"https://github.com/advisories/GHSA-wj4w-mc24-pcfm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103288.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-103288","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like","description":"Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"published","published":"2026-10-01T10:42:22.502Z","modified":"2026-10-01T13:28:31.759Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-90681","description":"Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"published","published":"2026-10-01T10:42:22Z","modified":"2026-10-01T13:28:31Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:46.486382Z"}],"ghsa":[{"id":"GHSA-qrh6-cwg3-343x","title":"Ghost: Authorization Bypass in Comment Like Feature","description":"### Impact\n\nAn input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v5.9.0 up to v6.44.1.\n\n### Patches\n\nv6.44.1 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).\n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).\n\n\n### References\n\nGhost thanks [Adel Assakaf](https://github.com/assakafpix) and [Arthur Gurunlian](https://github.com/Buggs777) as well as Geoffrey Diederichs of [Escape](https://escape.tech/) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-27T14:44:19Z","modified":"2026-10-27T14:44:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:41:36.858527Z"},{"id":"GHSA-wj4w-mc24-pcfm","title":"Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-qrh6-cwg3-343x. This link is maintained to preserve external references.\n\n## Original Description\nGhost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"withdrawn","published":"2026-10-01T12:31:19Z","modified":"2026-10-27T14:44:15Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-103288","description":"Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"published","published":"2026-10-01T11:17:25.2Z","modified":"2026-10-01T15:06:17.33Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:53.097633Z"}],"osv":[{"id":"CVE-2026-103288","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like","description":"Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"published","published":"2026-10-01T10:42:22.502Z","modified":"2026-10-28T02:31:11.325235818Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"GHSA-qrh6-cwg3-343x","title":"Ghost: Authorization Bypass in Comment Like Feature","description":"### Impact\n\nAn input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v5.9.0 up to v6.44.1.\n\n### Patches\n\nv6.44.1 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).\n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).\n\n\n### References\n\nGhost thanks [Adel Assakaf](https://github.com/assakafpix) and [Arthur Gurunlian](https://github.com/Buggs777) as well as Geoffrey Diederichs of [Escape](https://escape.tech/) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-27T14:44:19Z","modified":"2026-10-27T15:00:05.395290912Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"GHSA-wj4w-mc24-pcfm","title":"Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-qrh6-cwg3-343x. This link is maintained to preserve external references.\n\n## Original Description\nGhost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"withdrawn","published":"2026-10-01T12:31:19Z","modified":"2026-10-27T15:00:04.498745129Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"BIT-ghost-2026-103288","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like","description":"Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","status":"published","published":"2026-10-09T10:45:07.682Z","modified":"2026-10-09T12:10:38.709516668Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}