BIT-ghost-2026-105681

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105681.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-ghost-2026-105681

Aliases

Published

2026-10-13T06:50:34Z

Modified

2026-10-13T08:25:39Z

Summary

Ghost: Authorization Bypass in Comments Feature

Details

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / ghost

Package

Name: ghost
Purl: pkg:bitnami/ghost

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

5.9.0

Fixed

6.44.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105681.json"