{"id":"GHSA-wj4w-mc24-pcfm","kind":"vulnerability","aliases":["GHSA-wj4w-mc24-pcfm"],"related":[],"title":"Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-qrh6-cwg3-343x. This link is maintained to preserve external references.\n\n## Original Description\nGhost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.","summary":"Ghost versions 5.9.0 through 6.44.1 let an authenticated member delete comment likes or dislikes belonging to other users. The attacker gets unauthorized modification of comment engagement data, not code execution.","severity":"high","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ghost","fixed":["6.44.1"],"affected":">= 5.9.0, < 6.44.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-639","ghost","npm","runtime","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Check the installed Ghost version with `npm ls ghost` or the `version` field in `package.json` for self-hosted installs.\n- Confirm whether members can like comments on the site (comment likes enabled).","fix":"- Upgrade Ghost to `6.44.1` or later.\n- Note: the advisory was withdrawn as a duplicate of GHSA-qrh6-cwg3-343x; treat that advisory as the authoritative record.","status":"withdrawn","published_at":"2026-10-01T12:31:19+00:00","first_seen_at":"2026-10-27T14:47:35+00:00","triaged_at":"2026-10-27T14:49:35+00:00","updated_at":"2026-10-27T14:49:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T14:49:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ghost to `6.44.1` or later.\n- Note: the advisory was withdrawn as a duplicate of GHSA-qrh6-cwg3-343x; treat that advisory as the authoritative record.","reach":"internet","title":"Ghost: authenticated member can delete other users' comment likes","impact":"low","summary":"Ghost versions 5.9.0 through 6.44.1 let an authenticated member delete comment likes or dislikes belonging to other users. The attacker gets unauthorized modification of comment engagement data, not code execution.","category":"runtime","nicknames":[],"who_cares":["ghost","self-hosted","npm"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other members' comment likes and dislikes can be deleted by a logged-in member","analyst_note":"Advisory is withdrawn as duplicate; confirm the canonical record at GHSA-qrh6-cwg3-343x and whether the 6.44.1 fix matches.","how_to_check":"- Check the installed Ghost version with `npm ls ghost` or the `version` field in `package.json` for self-hosted installs.\n- Confirm whether members can like comments on the site (comment likes enabled).","needs_analyst":true,"not_affected_if":["managed-hosting","default-config"],"who_is_affected":"Self-hosted Ghost installs in the 5.9.0 to 6.44.1 range that have member comments with likes enabled are exposed. Sites on Ghost(Pro) managed hosting or with comments turned off have less exposure, though the managed status is not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000643,"input_tokens":3452,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-639':22B '343x':76C '5.9.0':31B,107C '6.44.1':33B,109C 'advisori':2A,60C,62C 'attack':48B 'authent':36B,111C 'author':4A,127C,133C 'belong':43B,119C 'bypass':5A,134C 'code':57B 'comment':7A,39B,53B,101C,115C,139C 'contain':94C 'cwe':21B 'cwg3':75C 'data':55B,141C 'delet':38B,114C,129C 'descript':86C 'dislik':42B,118C 'duplic':1A,59C,70C 'engag':54B,140C 'execut':58B 'extern':83C 'featur':9A,103C 'flaw':98C 'get':49B 'ghost':3A,20A,23B,29B,87C 'ghsa':11A,16A,73C 'ghsa-qrh6-cwg3-343x':72C 'ghsa-wj4w-mc24-pcfm':10A,15A 'host':28B 'input':96C 'let':34B 'like':8A,40B,102C,116C 'link':78C 'maintain':80C 'mc24':13A,18A 'member':37B,112C 'modif':51B,137C 'npm':24B 'open':90C 'open-sourc':89C 'origin':85C 'pcfm':14A,19A 'platform':93C 'preserv':82C 'publish':92C 'qrh6':74C 'refer':84C 'result':130C 'runtim':25B 'self':27B 'self-host':26B 'sourc':91C 'unauthor':50B,136C 'user':46B,122C 'valid':97C 'version':30B,105C 'withdrawn':65C 'wj4w':12A,17A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Ghost installs in the 5.9.0 to 6.44.1 range that have member comments with likes enabled are exposed. Sites on Ghost(Pro) managed hosting or with comments turned off have less exposure, though the managed status is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T12:31:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wj4w-mc24-pcfm","url":"https://github.com/advisories/GHSA-wj4w-mc24-pcfm","severity":"high","published_at":"2026-10-01T12:31:19+00:00","modified_at":"2026-10-27T14:44:15+00:00","first_seen_at":"2026-10-27T14:47:35+00:00","fetched_at":"2026-10-27T14:47:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}