CVE-2026-105681

Published: Oct 5, 2026Modified: Oct 6, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

Related CWEs

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

References (4)

https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/pull/28297

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/releases/tag/v6.44.1

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477

Source: security-advisories@github.com

Timeline

No history available yet.