CVE-2026-103288Medium· 6.5▾ SunlitGhost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that the…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
ghost >= 5.9.0, < 6.44.1Patched in:
ghost 6.44.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105681Medium· 6.5Ghost is a Node.js content management system
GHSA-wj4w-mc24-pcfmHigh· 6.5Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature
CVE-2026-105652Low· 3.1Ghost is a Node.js content management system
CVE-2026-105675High· 7.5Ghost is a Node.js content management system
CVE-2026-103289Medium· 6.5Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.
CVE-2026-59817Medium· 5.3Ghost: Paid gift memberships obtainable at minimal cost via the donations feature