CVE-2026-103289

MediumCVSS 6.5/10Last modified Oct 1, 2026

Description

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-943

Affected software

Vendor	Product	Versions
TryGhost	Ghost	>= 5.9.0, < 6.44.1

References

Timeline

Published: Oct 1, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1032903.8Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input v CVE-2026-1032916.4Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authe CVE-2026-1032928.0Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_h CVE-2026-1032936.8The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before tr CVE-2026-1032945.9CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An a CVE-2026-1032967.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security fea CVE-2026-1032977.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security fea CVE-2026-1032985.3The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely orig CVE-2026-1032995.3The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's CVE-2026-1033005.3The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely origin CVE-2026-1033015.3The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because th CVE-2026-1033025.3The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the