GHSA-wj4w-mc24-pcfmHigh· 6.5▾ TwilightDuplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-qrh6-cwg3-343x. This link is maintained to preserve external references.
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.
ghost >= 5.9.0, < 6.44.1Upgrade to a patched release:
ghost 6.44.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103288Medium· 6.5Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1
CVE-2026-59817Medium· 5.3Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
CVE-2026-105682Low· 2.7Ghost is a Node.js content management system
CVE-2026-105683Low· 3.8Ghost is a Node.js content management system
CVE-2026-105679High· 7.3Ghost is a Node.js content management system
CVE-2026-105680Medium· 6.5Ghost is a Node.js content management system