CVE-2026-105680

Published: Oct 5, 2026Modified: Oct 6, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/issues/30283

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/releases/tag/v6.60.0

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562

Source: security-advisories@github.com

Timeline

No history available yet.