cve.bz

CVE-2026-103289

7.1 highEPSS 0.2%

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

CVSS 4.0
7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-25)
CWE
CWE-943
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6q6j-f24j-p477npmghost>=5.9.0 <6.44.16.44.1

References

Check your stackJSON