---
id: "GHSA-wj4w-mc24-pcfm"
kind: "vulnerability"
aliases: ["GHSA-wj4w-mc24-pcfm"]
title: "Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature"
severity: "high"
cvss: 6.5
epss: null
exploited: false
status: "withdrawn"
category: "runtime"
products: [{"name": "ghost", "fixed": ["6.44.1"], "affected": ">= 5.9.0, < 6.44.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-639", "ghost", "npm", "runtime", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-01T12:31:19+00:00"
first_seen_at: "2026-10-27T14:47:35+00:00"
updated_at: "2026-10-27T14:49:35+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-wj4w-mc24-pcfm", "first_seen_at": "2026-10-27T14:47:35+00:00"}]
---

# Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature

Ghost versions 5.9.0 through 6.44.1 let an authenticated member delete comment likes or dislikes belonging to other users. The attacker gets unauthorized modification of comment engagement data, not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:ghost affected >= 5.9.0, < 6.44.1 fixed 6.44.1

## How to check

- Check the installed Ghost version with `npm ls ghost` or the `version` field in `package.json` for self-hosted installs.
- Confirm whether members can like comments on the site (comment likes enabled).

## Fix

- Upgrade Ghost to `6.44.1` or later.
- Note: the advisory was withdrawn as a duplicate of GHSA-qrh6-cwg3-343x; treat that advisory as the authoritative record.

## Timeline

- 2026-10-27T14:47:35+00:00 ghsa https://github.com/advisories/GHSA-wj4w-mc24-pcfm

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qrh6-cwg3-343x. This link is maintained to preserve external references.

## Original Description
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_