CVE-2026-103289: Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-943

Description

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

Affected products

TryGhost Ghost: from 5.9.0 before 6.44.1 — fixed in 6.44.1

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.44.1. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477
https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments

Get alerted when CVE-2026-103289 or the next vulnerability affects your stack