Ghost EUVD-2026-90667

Requires the target Ghost instance to be running in private mode (the site-level privacy setting that gates content), with comments enabled, on a version in the 5.3.0-to-before-6.58.0 range. No authentication, user interaction, or special privileges are needed - an unauthenticated remote visitor can read comments that private mode should restrict. The limiting factor is the configuration dependency: sites not using private mode, or with comments disabled, are not exposed, and impact is bounded to disclosure of comment text only (no write, no account access).

This is a genuine but low-impact confidentiality flaw, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L) confirms network-reachable, unauthenticated, low-complexity exploitation with only low confidentiality impact and no integrity or availability impact - the 6.9 score is inflated by the unauthenticated/no-interaction attributes rather than by severe impact. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so exploitation probability signals are absent (no public exploit identified at time of analysis). The data is internally consistent: CWE-862 (missing authorization) matches the description of access controls not being enforced on comments in private mode, and the network vector aligns with a web-reachable comment endpoint. The practical ceiling is disclosure of comment text that a private-mode site intended to keep behind its privacy gate - sensitive for some deployments (member-only or gated content) but not a path to account compromise or code execution. Overall: a real authorization bug worth patching promptly for private-mode Ghost sites, but low real-world urgency absent any exploitation signal.

An attacker identifies a Ghost blog running in private mode (intended to be hidden behind a shared password or member gate) and sends unauthenticated requests to the comment-retrieval endpoint. Because access controls on comments are not enforced in private mode, the server returns comment content that should have been restricted, letting the attacker read discussions meant only for authorized visitors. No proof-of-concept is referenced in the input; exploitation requires only an HTTP client.