{"id":"EUVD-2026-92772","enisaUuid":"caa3315b-e31a-38ff-a935-830c4f634372","description":"Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.","datePublished":"Oct 5, 2026, 7:27:11 PM","dateUpdated":"Oct 6, 2026, 2:51:00 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477\nhttps://github.com/TryGhost/Ghost/pull/28297\nhttps://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.44.1\n","aliases":"CVE-2026-105681\nGHSA-6q6j-f24j-p477\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"24243d51-ce01-343c-8c96-ee9d72241628","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.9.0, \u003c 6.44.1"}],"enisaIdVendor":[{"id":"f941807a-c57c-3bdb-a758-69555ff75d31","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"1315467f-04a0-37f9-92f7-8930ad3e76c1","vulnerability":{"id":"CVE-2026-105681","description":"Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.","datePublished":"Oct 5, 2026, 7:27:11 PM","dateUpdated":"Oct 6, 2026, 2:51:00 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477\nhttps://github.com/TryGhost/Ghost/pull/28297\nhttps://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.44.1\n","enisa_id":"EUVD-2026-92772\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 2, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"4e86a835-5fc0-3c78-b0b9-d7767a95a263","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.9.0, \u003c 6.44.1"}],"vulnerabilityVendor":[{"id":"02b92918-683c-3e34-b362-80a6fc82ce05","vendor":{"name":"TryGhost"}}]}},{"id":"235ae41b-4a26-3603-b932-abd20d12c5c6","vulnerability":{"id":"GHSA-6q6j-f24j-p477","description":"Ghost: Authorization Bypass in Comments Feature","datePublished":"Oct 7, 2026, 4:18:00 PM","dateUpdated":"Oct 7, 2026, 4:18:00 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105681\nhttps://github.com/TryGhost/Ghost/pull/28297\nhttps://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.44.1\n","enisa_id":"EUVD-2026-92772\n","aliases":"CVE-2026-105681\nGHSA-6q6j-f24j-p477\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}