CVE-2026-103289CWE-943

CVE-2026-103289

Medium · published October 1, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-10-01T15:17Z
References (2)
https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477 · [email protected]https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comments · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:42Z
    Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
    cvelistv5