CVE-2026-103288

Publié : 1 octobre 2026

Modifié : 1 octobre 2026

Score CVSS

6.5

MEDIUM

Description détaillée

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Références et Patchs

https://github.com/TryGhost/Ghost/security/advisories/GHSA-qrh6-cwg3-343x https://www.vulncheck.com/advisories/ghost-5.9.0-before-6.44.1-authorization-bypass-via-comment-like

Dernières Vulnérabilités

CVE-2026-97297

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

VOIR DÉTAILS

CVE-2026-97284

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

VOIR DÉTAILS

CVE-2026-97281

Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

VOIR DÉTAILS