Live › vulnerability › CVE-2026-103288
Go to dashboardGhost versions 5.9.0 through 6.44.1 have an input validation flaw that lets members delete comment likes and dislikes belonging to other users. The sources describe the impact as limited to deleting those reactions, not running code or reading data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:47 UTC, 0h before NVD. All times on this page are UTC.
Self-hosted Ghost instances in the affected range that have member accounts able to like or dislike comments are exposed. Sites on Ghost(Pro) managed hosting are handled by the vendor, and sites with no member comment reactions in use have less reason to worry.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ghost | npm | >= 5.9.0, < 6.44.1 | 6.44.1 |
ghost version in the Ghost-CLI install directory, or check the image tag for the Docker install, and confirm the version is below 6.44.1ghost entry in package.json or the lockfile for a version in the range >= 5.9.0, < 6.44.16.44.1 or laterghost image at 6.44.1 or later and recreate the container, following https://docs.ghost.org/install/docker#updating-ghostEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete.
This vulnerability is present in Ghost from v5.9.0 up to v6.44.1.
v6.44.1 contains a fix for this issue.
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Ghost thanks Adel Assakaf and Arthur Gurunlian as well as Geoffrey Diederichs of Escape for disclosing this vulnerability responsibly.
If you have any questions or comments about this advisory, email us at [email protected].
This page as .md · .json · in your agent: get_signal("CVE-2026-103288")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.