Ghost: Authorization Bypass in Comment Like Feature

Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. Patches v6.44.1 contains a fix for this issue. How to update For self-hosters using...

Authorization Bypass Through User-Controlled Key

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via an input validation flaw in the comment like/dislike deletion feature. An authenticated member can delete comment likes or dislikes belonging to other...