{"id":"CVE-2026-103289","aliases":["BIT-ghost-2026-103289","BIT-ghost-2026-105681","EUVD-2026-90682","GHSA-6q6j-f24j-p477","GHSA-83rv-pxjq-8h5x"],"status":"published","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00231,"percentile":0.14054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-943"],"published":"2026-10-01T10:42:23Z","modified":"2026-10-28T02:31:00Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"5.9.0"},{"fixed":"6.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"5.9.0"},{"fixed":"6.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"5.9.0"},{"fixed":"6.44.1"}]}],"bundled":2}],"products":[{"vendor":"tryghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477","tags":["vendor-advisory","web","advisory"]},{"url":"https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments","tags":["third-party-advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103289","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-83rv-pxjq-8h5x"},{"url":"https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3","tags":["web","fix"]},{"url":"https://github.com/TryGhost/Ghost/pull/28297","tags":["web","fix"]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.44.1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105681","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103289.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105681.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-103289","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","status":"published","published":"2026-10-01T10:42:23.205Z","modified":"2026-10-01T13:24:02.84Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-90682","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","status":"published","published":"2026-10-01T10:42:23Z","modified":"2026-10-01T13:24:02Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:46.486382Z"}],"ghsa":[{"id":"GHSA-83rv-pxjq-8h5x","title":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that...","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","status":"published","published":"2026-10-01T12:31:19Z","modified":"2026-10-01T12:31:24Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:12:40.571849Z"}],"nvd":[{"id":"CVE-2026-103289","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","status":"published","published":"2026-10-01T11:17:25.36Z","modified":"2026-10-01T15:06:17.33Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:12:53.097633Z"}],"osv":[{"id":"CVE-2026-103289","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","status":"published","published":"2026-10-01T10:42:23.205Z","modified":"2026-10-28T02:30:38.073301299Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"CVE-2026-105681","title":"Ghost: Authorization Bypass in Comments Feature","description":"Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.","status":"published","published":"2026-10-05T19:27:11.677Z","modified":"2026-10-28T02:31:00.006252256Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-6q6j-f24j-p477","title":"Ghost: Authorization Bypass in Comments Feature","description":"### Impact\n\nAn input validation issue allowed members to access comments they were not authorized to access.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v5.9.0 up to v6.44.1.\n\n### Patches\n\nv6.44.1 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).\n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).\n\n\n### References\n\nGhost thanks [Himanshu Anand](https://github.com/unknownhad) ([@anand_himanshu](https://twitter.com/anand_himanshu)) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-07T16:18:00Z","modified":"2026-10-13T08:25:39.115282662Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"BIT-ghost-2026-103289","title":"Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments","description":"Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.","status":"published","published":"2026-10-09T10:45:08.928Z","modified":"2026-10-13T08:25:39.115282662Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"BIT-ghost-2026-105681","title":"Ghost: Authorization Bypass in Comments Feature","description":"Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.","status":"published","published":"2026-10-13T06:50:34.258Z","modified":"2026-10-13T08:25:39.115282662Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}