CVE-2026-105681

medium

Description

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477

https://github.com/TryGhost/Ghost/releases/tag/v6.44.1

https://github.com/TryGhost/Ghost/pull/28297

https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92772

Details

Source: Mitre, NVD

Published: 2026-10-05

Updated: 2026-10-06

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N