CVE-2026-105681

MEDIUMCVSS 6.5

Description

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-943

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
https://github.com/TryGhost/Ghost/pull/28297
https://github.com/TryGhost/Ghost/releases/tag/v6.44.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477

Source: NIST NVD · Data may lag official sources by up to one minute