CVE-2026-105680 — Ghost: Authorization Issue Allowed Author Role to Delete any Post
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in …
Published: 2026-10-05 · CVSS: 6.5 · CVSS 3.1
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7