Ghost CMS CVE-2026-105680

Requires an authenticated staff account with the Author role on a multi-user Ghost instance running an affected version (5.81.0 up to but not including 6.60.0). The attacker must already possess valid Author-level credentials - there is no path for an anonymous or unauthenticated user - so single-author blogs and instances without delegated Author accounts are not realistically exposed. Exploitation targets posts and pages the attacker did not author; per the fix, both single deletes (now rejected unless the actor is the primary author) and bulk filter-based deletes were affected. The limiting factors are the required Author-role trust level and the existence of other authors' content to delete; no special non-default configuration or user interaction is needed beyond holding the Author role.

This is a moderate-severity broken-authorization flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-862 Missing Authorization). The CVSS vector shows network reach and low attack complexity, but the decisive constraint is PR:L: exploitation requires an already-provisioned Author-role staff account, so the realistic threat actor is a malicious or compromised low-trust staff member rather than an anonymous internet attacker. No EPSS score, SSVC decision, or CISA KEV status was supplied in the input, and no public exploit was identified - the only code artifact is the TryGhost fix commit itself, which is a patch, not weaponized exploit code. Weighing these signals together, this is a legitimate but bounded access-control issue: higher priority for multi-author Ghost instances that delegate content to semi-trusted contributors, and low priority for single-author or tightly-controlled deployments. The impact is scored as availability (A:H) for the destroyed posts/pages; note that unauthorized deletion of content is equally defensible as an integrity impact, so defenders should treat the harm as irreversible content loss regardless of which CVSS impact dimension is used.

On a multi-author Ghost site running 5.81.0-6.59.x, a user holding only the Author role (e.g. a freelance contributor or a compromised low-privilege staff account) sends an admin API delete request targeting a post or page authored by someone else. Because the authorization check only validated contributors as primary authors and failed to constrain the Author role, the deletion succeeds and the victim's content is permanently removed. No public exploit is required - the operation uses the normal admin API delete endpoint; the fix commit also confirms bulk-delete of posts and pages was blocked.