Servers and applications
GHSA-9c5c-w94h-xp32
Disclosure of Deleted and Hidden Comment Content via Members Comments API Filters
- Severity
- Medium 5.3
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 6.76.0
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Sources
- Project advisories (GitHub)
Description
Deleted and moderator-hidden comments that still have replies are kept in public comment threads as placeholders, with their content withheld. An unauthenticated visitor could use the public comments API to infer the original text of these comments.
This could expose content that a commenter chose to delete, or that a moderator hid, for example because it contained personal information. Before v5.101.0, all deleted and hidden comments were kept as placeholders and were affected.
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Workarounds
Disabling comments in Settings → Membership stops the Members comments API from returning comments.
Affected software
| Software | Affected versions |
|---|---|
GhostServers and applications · github:tryghost/ghost |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-9c5c-w94h-xp32
- github.com https://github.com/TryGhost/Ghost/security/advisories/GHSA-9c5c-w94h-xp32