High
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
Type: advisorySources: OSV
Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-103289, CVE-2026-105681
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:14 UTC · Revision 1
Source evidence
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
core-osv · Original sourcePublished 1 Oct 2026, 10:42 UTC
Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.
osv:CVE-2026-103289
Complete source record
{
"id": "96c2e6da43d02467801f622315f9b3d26853fc4ad6c09b94005421cd159ca177",
"url": "https://osv.dev/vulnerability/CVE-2026-103289",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments",
"summary": "Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.",
"evidence": "osv:CVE-2026-103289",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-103289",
"aliases": [
"BIT-ghost-2026-103289",
"BIT-ghost-2026-105681",
"CVE-2026-103289",
"CVE-2026-105681",
"GHSA-6q6j-f24j-p477"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tryghost/ghost",
"type": "GIT",
"events": [
{
"introduced": "b06b7c5dddbb3e473d4e98beebc0d15849fe3f5e"
},
{
"fixed": "ef3a6ceb761c263f573745e9c744838803231f95"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "5.9.0"
},
{
"fixed": "6.44.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "5.9.0"
},
{
"fixed": "6.44.1"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v6.44.0",
"v6.43.1",
"v6.43.0",
"v6.42.0",
"v6.41.1",
"v6.41.0",
"v6.40.0",
"v6.39.0",
"v6.38.0",
"v6.37.1",
"v6.37.0",
"v6.36.0",
"v6.35.0",
"v6.34.0",
"v6.33.0",
"v6.32.0",
"v6.31.0",
"v6.30.0",
"v6.29.1",
"v6.29.0",
"v6.28.0",
"v6.27.0",
"v6.26.0",
"v6.25.1",
"v6.25.0",
"v6.24.0",
"v6.23.0",
"v6.22.1",
"v6.22.0",
"v6.21.0",
"v6.21.2",
"v6.21.1",
"v6.20.1",
"v6.20.0",
"v6.19.4",
"v6.19.3",
"v6.19.2",
"v6.19.0",
"v6.19.1",
"v6.18.2",
"v6.18.0",
"v6.17.1",
"v6.17.0",
"v6.16.1",
"v6.16.0",
"v6.15.0",
"v6.14.0",
"v6.13.2",
"v6.13.1",
"v6.13.0",
"v6.12.0",
"v6.11.0",
"v6.10.3",
"v6.10.0",
"v6.9.3",
"v6.9.2",
"v6.9.0",
"v6.8.1",
"v6.8.0",
"v6.7.0",
"v6.6.0",
"v6.5.3",
"v6.5.2",
"v6.5.0",
"v6.4.0",
"v6.3.1",
"v6.2.0",
"v6.3.0",
"v6.1.0",
"v6.0.10",
"v6.0.8",
"v6.0.7",
"v6.0.6",
"v6.0.5",
"v6.0.4",
"v6.0.3",
"v6.0.1",
"v6.0.0",
"v6.0.0-rc.3",
"v6.0.0-rc.2",
"v6.0.0-rc.1",
"v6.0.0-rc.0",
"v6.0.0-alpha.2",
"v5.130.1",
"v5.130.0",
"v5.129.2",
"v5.129.1",
"v5.129.0",
"v5.128.0",
"v5.127.1",
"v5.127.0",
"v5.126.0",
"v5.125.1",
"v5.122.0",
"v5.121.0",
"v5.120.2",
"v5.120.0",
"v5.119.2",
"v5.119.0",
"v5.118.1",
"v5.118.0",
"v5.117.0",
"v5.116.2",
"v5.116.0",
"v5.115.1",
"v5.114.0",
"v5.113.0",
"v5.112.0",
"v5.111.0",
"v5.110.2",
"v5.110.0",
"v5.109.6",
"v5.109.3",
"v5.109.0",
"v5.108.1",
"v5.108.0",
"v5.107.0",
"v5.106.1",
"v5.106.0",
"v5.105.0",
"v5.104.0",
"v5.103.0",
"v5.102.0",
"v5.101.6",
"v5.101.4",
"v5.101.0",
"v5.99.0",
"v5.100.0",
"v5.98.0",
"v5.97.0",
"v5.96.1",
"v5.96.0",
"v5.95.0",
"v5.94.2",
"v5.94.1",
"v5.94.0",
"v5.93.0",
"v5.92.0",
"v5.91.0",
"v5.90.0",
"v5.89.2",
"v5.89.1",
"v5.89.0",
"v5.88.2",
"v5.88.1",
"v5.88.0",
"v5.87.2",
"v5.87.1",
"v5.87.0",
"v5.86.2",
"v5.86.1",
"v5.86.0",
"v5.85.1",
"v5.85.0",
"v5.84.2",
"v5.84.1",
"v5.84.0",
"v5.83.0",
"v5.82.12",
"v5.82.11",
"v5.82.9",
"v5.82.6",
"v5.82.4",
"v5.82.3",
"v5.82.2",
"v5.82.1",
"v5.82.0",
"v5.81.1",
"v5.81.0",
"v5.80.4",
"v5.80.3",
"v5.80.2",
"v5.80.0",
"v5.79.5",
"v5.79.3",
"v5.79.2",
"v5.79.1",
"v5.79.0",
"v5.78.0",
"v5.77.0",
"v5.76.0",
"@tryghost/portal@2.37.0",
"@tryghost/portal@2.36.5",
"v5.75.0",
"v5.74.4",
"v5.74.0",
"v5.73.1",
"v5.73.0",
"v5.72.0",
"v5.71.0",
"v5.70.1",
"v5.70.0",
"v5.69.1",
"v5.69.0",
"v5.68.0",
"v5.67.1",
"v5.67.0",
"v5.66.0",
"v5.65.0",
"v5.63.0",
"v5.62.0",
"v5.61.0",
"v5.60.0",
"@tryghost/comments-ui@0.13.0",
"v5.59.2",
"v5.59.0",
"v5.58.0",
"v5.57.0",
"v5.56.0",
"v5.55.0",
"v5.54.2",
"v5.54.1",
"v5.54.0",
"v5.53.3",
"v5.53.1",
"@tryghost/announcement-bar@1.1.7",
"@tryghost/portal@2.33.4",
"@tryghost/portal@2.33.3",
"v5.53.0",
"@tryghost/announcement-bar@1.1.6",
"@tryghost/signup-form@0.1.3",
"v5.52.0",
"@tryghost/admin-x-settings@0.0.8",
"@tryghost/signup-form@0.1.2",
"@tryghost/portal@2.33.2",
"@tryghost/admin-x-settings@0.0.7",
"@tryghost/signup-form@0.1.1",
"v5.51.0",
"@tryghost/signup-form@0.1.0",
"@tryghost/signup-form@0.0.3",
"@tryghost/portal@2.33.1",
"v5.49.3",
"@tryghost/portal@2.33.0",
"v5.49.1",
"@tryghost/signup-form@0.0.1",
"@tryghost/admin-x-settings@0.0.6",
"@tryghost/portal@2.32.0",
"@tryghost/portal@2.31.2",
"v5.48.0",
"@tryghost/admin-x-settings@0.0.5",
"@tryghost/admin-x-settings@0.0.4",
"@tryghost/admin-x-settings@0.0.3",
"@tryghost/admin-x-settings@0.0.2",
"v5.47.1",
"@tryghost/portal@2.31.1",
"@tryghost/portal@2.31.0",
"@tryghost/portal@2.30.1",
"v5.47.0",
"@tryghost/portal@2.30.0",
"v5.46.0",
"v5.45.1",
"v5.45.0",
"v5.44.0",
"@tryghost/portal@2.29.3",
"@tryghost/portal@2.29.2",
"v5.43.0",
"@tryghost/portal@2.29.1",
"@tryghost/portal@2.29.0",
"v5.42.2",
"@tryghost/portal@2.28.1",
"v5.42.0",
"@tryghost/portal@2.28.0",
"@tryghost/portal@2.27.0",
"v5.41.0",
"@tryghost/portal@2.26.0",
"v5.40.1",
"v5.40.0",
"v5.39.0",
"v5.38.0",
"v5.37.0",
"v5.36.0",
"v5.35.0",
"@tryghost/portal@2.25.0",
"v5.34.0",
"v5.33.0",
"v5.31.0",
"v5.30.1",
"v5.30.0",
"v5.28.0",
"@tryghost/portal@2.24.1",
"@tryghost/portal@2.24.0",
"v5.27.0",
"@tryghost/portal@2.23.0",
"v5.26.4",
"v5.26.3",
"v5.26.2",
"v5.26.1",
"v5.26.0",
"v5.25.5",
"@tryghost/portal@2.22.0",
"v5.25.3",
"@tryghost/portal@2.21.0",
"v5.25.0",
"@tryghost/portal@2.20.3",
"@tryghost/portal@2.20.2",
"v5.24.0",
"v5.23.0",
"@tryghost/portal@2.20.1",
"@tryghost/portal@2.20.0",
"v5.22.10",
"@tryghost/portal@2.19.9",
"v5.22.6",
"@tryghost/portal@2.19.8",
"@tryghost/portal@2.19.7",
"@tryghost/portal@2.19.6",
"@tryghost/portal@2.19.5",
"v5.21.0",
"@tryghost/portal@2.19.3",
"@tryghost/portal@2.18.0",
"@tryghost/portal@2.17.0",
"@tryghost/portal@2.16.0",
"v5.20.0",
"v5.19.0",
"v5.18.0",
"@tryghost/portal@2.14.0",
"@tryghost/portal@2.13.2",
"v5.17.0",
"v5.16.0",
"v5.15.0",
"v5.14.0",
"v5.13.0",
"v5.12.1",
"v5.12.0",
"v5.11.0",
"v5.10.0",
"v5.9.4",
"v5.9.3",
"v5.9.2",
"v5.9.1",
"v5.9.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103289.json"
}
}
],
"modified": "2026-10-28T02:30:38.073301299Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103289.json",
"https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477",
"https://nvd.nist.gov/vuln/detail/CVE-2026-103289",
"https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments"
],
"provider_metadata": {
"cwe_ids": [
"CWE-943"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103289.json"
}
},
"related_cves": [
{
"value": "CVE-2026-103289",
"evidence": "/id"
},
{
"value": "CVE-2026-105681",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505215,
"published_at": "2026-10-01T10:42:23.205+00:00"
}