Improper Neutralization of Special Elements in Data Query Logic in Ghost - #VU142534
Published: August 14, 2026
Vulnerability identifier: #VU142534
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify comment like or dislike data they are not authorized to delete.
The vulnerability exists due to improper access control in the comment like feature when handling delete requests for comment likes or dislikes. A remote user can send a crafted request to modify comment like or dislike data they are not authorized to delete.
Affected software
Ghost
Remediation
Install security update from vendor's website.
Ghost - update to 6.44.1