EUVD-2026-90681
GHSA-wj4w-mc24-pcfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Ghost member
-
DeliveryEnumerate others' like/dislike object IDs
-
ExploitSend crafted delete request
-
ExecutionBypass ownership check
-
ImpactRemove other users' comment engagement data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated Ghost membership account (PR:L) on a site running Ghost 5.9.0 through 6.44.0 with the comment-likes feature in use; the comments/membership feature must be enabled for the comment-like endpoint to exist. Exploitation is remote over the network with low complexity and no user interaction, but is limited to tampering with comment like/dislike engagement data belonging to other members - it does not expose data or affect availability. The member-authentication requirement and the trivial nature of the affected data are the key limiting factors. |
| Impact | This is a textbook high-CVSS-but-low-real-risk issue. The vendor/VulnCheck CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1 by rating vulnerable-system integrity as HIGH, but the actual integrity impact - an authenticated member deleting other members' comment likes/dislikes - affects only non-sensitive comment engagement counters, with no confidentiality (VC:N) and no availability (VA:N) consequence. There is no public exploit identified at time of analysis and no EPSS/KEV data provided, so no signal of active or probable exploitation. SSVC data was not supplied. The signals are internally consistent on access (network, low complexity, authenticated member, no user interaction) but the VI:H rating overstates business impact; a more defensible integrity rating is LOW given the trivial data at stake. Net: a legitimate authorization-bypass bug worth patching, but not an urgent priority relative to its 7.1 score. |
| Exploit ScenarioDerived | An attacker registers or uses an existing Ghost membership account (PR:L) and issues a crafted authenticated API request referencing a like/dislike object ID owned by another member. Because the comment-like feature fails to verify ownership (CWE-639 IDOR), the request succeeds and removes another user's like or dislike, tampering with comment engagement metrics. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Authenticated members on Ghost sites running versions 5.9.0 through 6.44.0 can delete comment likes and dislikes that belong to other users, allowing an authorization bypass that silently corrupts other members' comment engagement data. The flaw is an IDOR-style access-control failure (CWE-639) in the comment-like feature, reachable over the network with low complexity, but it requires a valid membership account and only permits integrity tampering with non-sensitive engagement counters - it does not expose data or affect availability. Vendor patch 6.44.1 is available, and no public exploit code was identified at time of analysis; the reported CVSS 4.0 score of 7.1 overstates real-world risk given the low-value target data and authenticated prerequisite.
RemediationAI
Upgrade Ghost to 6.44.1 or later - the vendor-released patch that enforces per-object ownership checks on the comment-like delete path - following the guidance in the advisory at https://github.com/TryGhost/Ghost/security/advisories/GHSA-qrh6-cwg3-343x. If an upgrade cannot be applied immediately, the most effective compensating control is to disable the native comments feature (and thereby the comment-like endpoint) for the affected site, accepting the loss of member discussion functionality; alternatively, restrict commenting to trusted roles or temporarily require moderation, though this does not remove the underlying IDOR for users who retain like privileges. Because exploitation needs only an ordinary member account, review membership registration approvals or invite-only settings to limit who can obtain the authenticated session the attack requires, and audit logs for unusual bulk removals of comment likes if the endpoint has been exposed. Patch status per vendor data: Patch available from vendor (fixed in 6.44.1); no vendor-released patch exists for 6.44.0 or earlier, so upgrading is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ghost is an open-source, Node.js-based publishing and newsletter platform whose members feature adds subscriber accounts, gated content, and a native comments system. CVE-2026-103288 is a CWE-639 (Authorization Bypass Through User-Controlled Key) defect: the comment-like endpoint accepts a like/dislike identifier supplied by the client and performs the delete without verifying that the requesting member owns that like record. Because the object key is attacker-controlled and only a membership-level session is checked (not per-object ownership), any authenticated member can enumerate or guess identifiers for likes/dislikes created by other members and remove them. The weakness lives in the comment engagement subsystem introduced in the 5.9.0 line, which is why the affected CPE cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* spans 5.9.0 up to (but excluding) 6.44.1. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N confirms a network-reachable, low-complexity, low-privilege integrity-only impact, consistent with our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), which scores the practical consequence lower because only engagement metadata is altered.
Know when Ghost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Authenticated member over network with low complexity (PR:L, AC:L, UI:N); only low-value comment engagement data is modified so I:L, with no confidentiality or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.
Technical POC Analysis
Evidence note: the supplied material is the GitHub advisory GHSA-qrh6-cwg3-343x only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Ghost sites running versions 5.9.0 through 6.44.0 are exposed to a comment-engagement integrity flaw that lets a valid member delete other members' comment likes and dislikes, silently corrupting engagement data. While rated high severity, the practical organizational impact is limited because it does not expose sensitive information or disrupt site availability, and no public exploit identified at time of analysis. Leadership should care because member trust and community metrics can be undermined if left unpatched, but Vendor-released patch: 6.44.1 is available and remediation is straightforward.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Ghost CMS versions 5.105.0-5.130.5 and 6.0.0-6.10.3 contain an authentication bypass in their two-factor authentication
Arbitrary code execution in Ghost CMS versions 0.7.2 through 6.19.0 allows authenticated attackers with theme upload pri
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitr
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary
SQL injection in Ghost CMS versions 3.24.0 through 6.19.0 allows unauthenticated attackers to read arbitrary database da
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any acco
Ghost before 5.82.0 allows CSV Injection during a member CSV export. Rated high severity (CVSS 8.8), this vulnerability
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external netw
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2
Ghost is a Node.js CMS. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication
Ghost is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely expl
Exploit-DB