CVE-2026-105681: falha de média gravidade em TryGhost Ghost
Ghost: Authorization Bypass in Comments Feature
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
probabilidade de exploração
0.3%top 84% das CVEs
exploração observada
nãonenhuma fonte reporta
Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
TryGhost · GhostCVEs relacionadas — TryGhost Ghost
No mesmo produto, das mais perigosas para as menos.
CVE-2023-40028MEDIUMArbitrary file read via symlinks in GhostEPSS 69.0%CVE-2023-31133HIGHGhost vulnerable to disclosure of private API fieldsEPSS 45.7%CVE-2021-29484MEDIUMDOM XSS in Theme PreviewEPSS 7.9%CVE-2026-29053HIGHGhost Vulnerable to Remote Code Execution via Malicious ThemesEPSS 5.0%CVE-2026-26980CRITICALGhost has a SQL Injection in its Content APIEPSS 5.0%CVE-2026-22594HIGHGhost has Staff 2FA bypassEPSS 1.3%