p PatchFirst

CVE-2026-105680

CVE-2026-105680 · Ghost: Authorization Issue Allowed Author Role to Delete any Post

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • >= 5.81.0, < 6.60.0: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 5.81.0, < 6.60.0

    Update to 6.60.0

Original sources

Check your server →