CVE-2026-105681: Ghost CMS Authorization Bypass Vulnerability

CVE-2026-105681 Overview

CVE-2026-105681 is an authorization flaw in Ghost, a Node.js content management system. Versions from 5.9.0 through 6.44.0 allow authenticated members to access comments they are not authorized to view. The issue stems from the comment-replies API endpoint invoking an administrative read path for member requests. Ghost version 6.44.1 resolves the issue by routing member requests through the proper authorization-aware controller.

Critical Impact

Authenticated members can read private or restricted comments on affected Ghost installations, leading to confidentiality loss across member-tier content.

Affected Products

• Ghost CMS versions 5.9.0 through 6.44.0
• Self-hosted Ghost deployments running Node.js
• Ghost(Pro) instances prior to the 6.44.1 rollout

Discovery Timeline

• 2026-10-05 - CVE-2026-105681 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in NVD database
• Patch released in Ghost v6.44.1 referenced in GitHub Security Advisory GHSA-6q6j-f24j-p477

Technical Details for CVE-2026-105681

Vulnerability Analysis

The flaw resides in the comment replies endpoint under ghost/core/core/server/api/endpoints/comment-replies.js. The query handler forced the request frame to administrative mode by setting frame.options.isAdmin = true before delegating to commentsService.controller.read(frame). Treating member traffic as administrative bypassed the membership permission checks that normally scope comment visibility. The weakness is categorized under [CWE-943: Improper Neutralization of Special Elements in Data Query Logic].

The issue is accessible over the network and requires only low-privileged authentication (a valid member account). No user interaction is required to abuse the endpoint. The impact is limited to confidentiality; integrity and availability remain unaffected.

Root Cause

The root cause is incorrect privilege propagation inside the API endpoint. By marking the request frame as administrative, the controller skipped the member-scoped authorization logic. The dedicated adminRead method should have been reserved for administrative sessions, while member sessions should have used the standard read path with full permission enforcement.

Attack Vector

An attacker who authenticates as a Ghost member can request comment replies through the vulnerable endpoint. The backend returns comment data without validating that the member is authorized to view the parent comment or thread. This exposes member-only or restricted discussions to any logged-in member.

// Patched handler in ghost/core/core/server/api/endpoints/comment-replies.js
        },
        permissions: true,
        query(frame) {
-            frame.options.isAdmin = true;
-            return commentsService.controller.read(frame);
+            return commentsService.controller.adminRead(frame);
        }
    }
};

Source: TryGhost/Ghost commit 405c2623. The patch removes the forced isAdmin flag and replaces the generic read call with an explicit adminRead controller that performs its own authorization checks.

Detection Methods for CVE-2026-105681

Indicators of Compromise

• Unusual volume of GET requests to the /comments/*/replies API endpoint from a single member session.
• Member accounts accessing comment identifiers that do not correspond to posts they have previously viewed or interacted with.
• Spikes in Ghost API traffic authenticated with member JWTs rather than staff tokens.

Detection Strategies

• Review Ghost access logs for requests to comment-replies endpoints returning HTTP 200 against comments scoped to other members.
• Correlate member session identifiers against the comments they retrieved to identify cross-tier access anomalies.
• Enable verbose API logging on Ghost and ship logs to a centralized analytics platform for behavioral baselining.

Monitoring Recommendations

• Alert when a single member session enumerates more than a baseline number of distinct comment IDs within a short window.
• Monitor for member-authenticated requests that previously would have been rejected after upgrading to 6.44.1.
• Track outbound data volume from the comments API to detect bulk scraping behavior.

How to Mitigate CVE-2026-105681

Immediate Actions Required

• Upgrade all Ghost installations to version 6.44.1 or later without delay.
• Audit member accounts for suspicious activity against the comment-replies endpoint since the 5.9.0 release.
• Rotate member session secrets if evidence of enumeration is identified during the audit.

Patch Information

The fix is included in Ghost v6.44.1 via pull request #28297. The patched handler calls commentsService.controller.adminRead(frame) only in administrative contexts, ensuring member requests pass through the permission-aware read logic. Full details are documented in GHSA-6q6j-f24j-p477.

Workarounds

• No official workaround exists; upgrading to 6.44.1 is the only supported remediation.
• Temporarily disable member comments or restrict the comments feature at the reverse proxy if patching cannot be performed immediately.
• Place the Ghost admin and member APIs behind a web application firewall (WAF) rule that rate-limits authenticated access to /comments/*/replies.

# Upgrade Ghost CLI deployments to the patched release
ghost update --version 6.44.1

# Verify the running version after upgrade
ghost version