CVE-2026-103274: Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.58.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Ghost deployments running version 5.3.0 or later but earlier than 6.58.0 are affected when private mode is used to restrict comment access.
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected Ghost site. No authentication, privileges, or user interaction are required.
What information can be exposed?
Unauthenticated visitors can read comments that private-mode access controls should restrict. The reported impact is limited to confidentiality.
How can I remediate the issue?
Upgrade Ghost to version 6.58.0 or later. The provided information does not identify an alternative mitigation if upgrading cannot be performed immediately.