Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M
CVE-2026-105680Ghost: Authorization Issue Allowed Author Role to Delete any Post
Medium 6.5
In plain English
A medium-severity missing authorization in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | ghost | 6.60.0 | GHSA-x3mg-q38v-m562 |
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562 x_refsource_CONFIRM
- https://github.com/TryGhost/Ghost/issues/30283 x_refsource_MISC
- https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165 x_refsource_MISC
- https://github.com/TryGhost/Ghost/releases/tag/v6.60.0 x_refsource_MISC