GHSA-6q6j-f24j-p477 BIT-ghost-2026-103289 BIT-ghost-2026-105681 CVE-2026-103289 CVE-2026-105681
Ghost: Authorization Bypass in Comments Feature
- Severity
- 7.1 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.26%
- Chance of exploitation in the next 30 days. Higher than 17.80% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
- Fix
6.44.1- Upgrade ghost to this version or later
Description
Impact
An input validation issue allowed members to access comments they were not authorized to access.
Vulnerable versions
This vulnerability is present in Ghost from v5.9.0 up to v6.44.1.
Patches
v6.44.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Himanshu Anand (@anand_himanshu) for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| ghost | >= 5.9.0, < 6.44.1 |
6.44.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ghost npm → 6.44.1
- npm
npm install ghost@6.44.1- yarn
yarn add ghost@6.44.1- pnpm
pnpm add ghost@6.44.1
Severity breakdown
CVSS 4.0 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
References
Advisories
Packages
Other links
- github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477
- github.com/TryGhost/Ghost/pull/28297
- github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
- github.com/TryGhost/Ghost/releases/tag/v6.44.1
- vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-x3mg-q38v-m562 Ghost: Authorization Issue Allowed Author Role to Delete any Post | Medium | Also affects ghost |
| GHSA-8575-cr6v-7jh4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization | High | Also affects ghost |
| GHSA-r7f2-6fj8-6fg2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses | Medium | Also affects ghost |
| GHSA-322m-ff4g-9vx9 Ghost: Server-Side Request Forgery in Bookmark Fetching | Medium | Also affects ghost |
| GHSA-fwh9-qg68-vxp4 Ghost: Regular Expression Denial of Service in Content Import | Medium | Also affects ghost |
| GHSA-9m4w-fmjw-fvjq Ghost: Regular Expression Denial of Service in External Media Inliner | Medium | Also affects ghost |
| GHSA-hqq2-xqr2-fmx2 Ghost : Stored XSS via SVG Files in Content Imports | Medium | Also affects ghost |
| GHSA-69qc-f5m6-889c Ghost: Stored XSS via Embed Card Previews | High | Also affects ghost |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor