CVE-2026-103289: Ghost Package Authorization Bypass in Comments Feature
Summary
CVE-2026-103289: Ghost: Authorization Bypass in Comments Feature. Affects ghost versions >= 5.9.0, < 6.44.1. Fixed in 6.44.1. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-103289 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source content management system built on Node.js, designed for professional publishing. It offers a user-friendly interface, customizable themes, and a robust API for developers. However, versions 5.9.0 to 6.44.1 are vulnerable to an input validation issue that allows unauthorized access to comments, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from a flaw in input validation within the comments feature of Ghost. This flaw allows users to access comments that they should not have permission to view, potentially exposing sensitive information. The issue affects all versions from 5.9.0 up to 6.44.1, and it is crucial for users to understand the implications of unauthorized access, which can lead to data breaches and loss of user trust.
How To Fix
Minimum fixed version
6.44.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the comments feature by modifying user roles and permissions until the package is updated. However, the best solution is to apply the patch as soon as possible.
Conclusion
The Ghost package has a critical vulnerability that allows unauthorized access to comments, affecting versions 5.9.0 to 6.44.1. It is essential to update to version 6.44.1 or later to mitigate this risk. Additionally, users can utilize tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for ghost →
FAQ
The vulnerability is an authorization bypass that allows unauthorized users to access comments they should not be able to view.
Versions from 5.9.0 to 6.44.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to sensitive comments, which can lead to data breaches and loss of user trust.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
