CVE-2026-105681

6.5 mediumEPSS 0.3%

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

CVSS 3.1: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)
CWE: CWE-943
Published: 2026-10-05
Modified: 2026-10-06
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-6q6j-f24j-p477	npm	ghost	>=5.9.0 <6.44.1	6.44.1

References

https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
https://github.com/TryGhost/Ghost/pull/28297
https://github.com/TryGhost/Ghost/releases/tag/v6.44.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477

Check your stack JSON