Summary
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Advisory details
Impact
Staff with the Author role could delete posts and pages that they did not author.
Vulnerable versions
This vulnerability is present in Ghost from v5.81.0 up to v6.60.0.
Patches
v6.60.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Ethan Wilkins of Armadin, Mihir Shishulkar, Jan Kahmen of TuringPoint, and Hao Long for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
References
- https://github.com/advisories/GHSA-x3mg-q38v-m562
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562
- https://nvd.nist.gov/vuln/detail/CVE-2026-105680
- https://github.com/TryGhost/Ghost/issues/30283
- https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165
- https://github.com/TryGhost/Ghost/releases/tag/v6.60.0
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- CRITICALCVE-2026-102748
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- HIGHCVE-2026-85990
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
- HIGHCVE-2026-84315
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
- MEDIUMGHSA-3hc7-r24j-rpwc
Vikunja: Cross-project task disclosure through subtask expansion
- MEDIUMGHSA-g38j-7v97-x298
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID