CVE-2026-105680

Ghost: Authorization Issue Allowed Author Role to Delete any Post

State: Published
Severity: 6.5 Medium
Published: Oct 5, 2026
Updated: Oct 6, 2026
Reserved: Oct 5, 2026

Description

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
GhostTryGhost	>= 5.81.0, < 6.60.0Affected

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562
https://github.com/TryGhost/Ghost/issues/30283
https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165
https://github.com/TryGhost/Ghost/releases/tag/v6.60.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.