What is the CVSS score of EUVD-2026-90682?

EUVD-2026-90682 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-90682?

Within 24 hours, inventory all Ghost instances and confirm which are running versions 5.9.0 through 6.44.0 with membership and the native comments feature enabled; treat those as the priority population and apply the vendor patch (upgrade to the latest patched release above 6.44.0) to any internet-facing or production instance. Within 7 days, complete the upgrade across all remaining affected instances, verify the installed version post-upgrade, audit member account provisioning so that self-registration is reviewed or gated where comments contain sensitive material, and review comment visibility settings and recent access logs for signs of unexpected retrieval of restricted threads. Within 30 days, confirm full remediation through configuration or asset management reporting, re-test the comments feature with a low-privilege member account to validate that restricted content is no longer accessible, and update patching SLAs so critical membership-platform updates are applied within the same cadence going forward.

Ghost CMS EUVD-2026-90682

Q: Which versions of Ghost CMS are affected by EUVD-2026-90682?

Ghost, the publishing and membership platform, exposes restricted comment content to any authenticated member on sites running versions 5.9.0 through 6.44.0 that have the native comments feature…. A patch is available.

| CVE-2026-103289 HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-10-01 VulnCheck

GHSA-83rv-pxjq-8h5x

Information Disclosure Nosql Injection Ghost Tryghost

7.1

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Register or log in as Ghost member
Exploit

Craft malicious comments query/filter
Execution

Bypass comment authorization check
Impact

Read restricted comment data

Vulnerability Assessment

Weakness	CWE CWE-943 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Query language parameterization
Exploitation Conditions	Requires an authenticated Ghost member account (PR:L) on a site running an affected version (5.9.0 through 6.44.0) that has the native comments feature enabled. Exploitation is remote over the network with low complexity and no user interaction, but is limited to sites that actually use Ghost comments and to data reachable through that feature - impact is confined to disclosure of restricted comment content (VC:H, no integrity or availability impact). Sites without membership/comments enabled, or already upgraded to 6.44.1, are not exposed.
Impact	The only quantitative signal provided is the vendor/VulnCheck CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), which describes a network-reachable, low-complexity authorization bypass requiring low privileges (PR:L - an authenticated Ghost 'member' account) and no user interaction, with high confidentiality impact and no integrity or availability impact. There is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent - a pure confidentiality (VC:H only) disclosure flaw reached by any registered member - so this is a genuine but bounded issue: real priority for any Ghost site that uses paid/members-only commenting, but not an unauthenticated internet-wide mass-exploitation candidate, since it is gated behind membership authentication (PR:L) and leaks data rather than granting code execution or takeover. CWE-943 and the 'Nosql Injection' tag imply the authorization failure stems from query-logic manipulation; the VulnCheck advisory frames it as an 'authorization bypass via comments,' which is consistent with the description's 'input validation issue … allows authenticated members to access comments they are not authorized to view.'
Exploit ScenarioDerived	An attacker registers (or already holds) a free or paid member account on a Ghost-powered site that uses the native comments feature, then sends a crafted request to the comments API/query interface that manipulates the query logic (CWE-943 / NoSQL injection) to retrieve comments outside their authorized scope - for example restricted, members-tier, or otherwise access-controlled comment data. No user interaction or elevated privileges are needed beyond a basic member login. No public proof-of-concept is currently referenced.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Authenticated Ghost members on sites running versions 5.9.0 through 6.44.0 can read comments they are not authorized to view, resulting in disclosure of restricted comment content through the native comments feature. The root cause is an input validation / query-logic authorization bypass (CWE-943), reachable over the network with low complexity and no user interaction; the vendor and VulnCheck assign a CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), which our assessment maps to a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no integrity or availability impact. Exposure is conditional on the site having membership and the native comments feature enabled and running an affected version; exploitation requires a valid low-privilege member account (PR:L), and no public exploit code has been identified at time of analysis.

RemediationAI

Vendor-released patch: upgrade Ghost to 6.44.1 or later, which is the first fixed release per the vendor advisory at https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477; the VulnCheck advisory at https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments documents the same authorization bypass. Where an immediate upgrade is not possible, the most effective compensating control is to disable the native comments feature in Ghost admin, which removes the vulnerable read path entirely at the cost of losing member comment functionality; alternatively, disable or tightly restrict member signups and pause open membership so that PR:L (an authenticated member account) cannot be obtained by untrusted users, though this narrows rather than eliminates the risk for existing members. Because the flaw only exposes restricted comment data and has no integrity or availability impact, no caching, WAF, or rate-limiting control fully mitigates it - those measures at best reduce bulk harvest of the exposed comments and should be treated as temporary. After upgrading, audit comment visibility settings and review recently accessed restricted comment content for signs of unauthorized disclosure, and verify the running version through the Ghost admin about page or the /ghost/api/admin/site endpoint.

Affected VersionsENISA

Ghost 5.9.0 <6.44.1

Affected Packages

npm ghost fix: 6.44.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Ghost is a Node.js-based publishing platform/CMS whose native comments feature was introduced in the 5.9.0 line, storing and serving member comments through a backend data store and exposing them to the front-end and to member-authenticated API paths. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) describes the underlying defect class here: rather than a memory-safety bug, this is an authorization/query-construction failure in which comment-retrieval logic does not correctly constrain the query to the requesting member's permitted scope, so a crafted request returns comments the member should not see. The record's tags additionally label it an information disclosure and a NoSQL-injection-style issue, which is consistent with attacker-controlled input influencing a query rather than with template injection or remote code execution. The CPE cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* and EUVD entry EUVD-2026-90682 both scope the problem to Ghost 5.9.0 <6.44.1, and the vendor advisory (GHSA-6q6j-f24j-p477) is the authoritative source for the affected code path. Because the flaw is confined to read access over the comments subsystem, there is no write, privilege-escalation, or denial-of-service component in the assessed impact.

Know when Ghost gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 6.5 MEDIUM

Network-reachable comments API exploitable by any authenticated member (PR:L), low complexity, no interaction; confidentiality-only disclosure so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Oct 01, 2026 - 11:01 EUVD

CVE Published

Oct 01, 2026 - 10:42 cve.org

HIGH 7.1

DescriptionCVE.org

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

Technical POC Analysis

CWE-943 (Improper Neutralization of Special Elements in Data Query Logic).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

Ghost, the publishing and membership platform, exposes restricted comment content to any authenticated member on sites running versions 5.9.0 through 6.44.0 that have the native comments feature enabled. Because member accounts are typically self-service and low-privilege, this flaw effectively lowers the barrier to viewing private member discussions, which may contain sensitive community, customer, or editorial content. Leadership should care because the exposure is confidentiality-only but broad in reach across the affected membership base, with no public exploit identified at time of analysis and a vendor patch available.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

Medium

popular open-source publishing platform, common but not everywhere

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

NoSQL Injection HIGH

NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.