medium6.5
CVE-2026-105680
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Impact
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ghost | >= 5.81.0, < 6.60.0 | 6.60.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-x3mg-q38v-m562
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562
- https://nvd.nist.gov/vuln/detail/CVE-2026-105680
- https://github.com/TryGhost/Ghost/issues/30283
- https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165
- https://github.com/TryGhost/Ghost/releases/tag/v6.60.0