EUVD-2026-56035
GHSA-x7gh-ph2w-vvr2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable via standard Admin API; Author-role account (PR:L) required; no confidentiality impact; irreversible post deletion yields high integrity and availability loss.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.
AnalysisAI
Broken access control in Ghost Foundation Ghost 5.x enables any authenticated Author-role user to delete posts owned by other users, including content published by Editors and Administrators. The authorization failure originates in the post model's permissible() cascade, where the combined isAuthor-and-isDestroy condition is not handled, causing the guard to fall through and approve the deletion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Author-role account on the target Ghost instance - the account may be legitimately issued, socially engineered, or obtained via credential compromise. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-calibrated: the attack requires no special network position, no elevated privileges beyond a standard Author account, and no user interaction, while producing irreversible data destruction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version was confirmed in the available intelligence - operators should monitor the Ghost GitHub repository at https://github.com/TryGhost/Ghost for a release that addresses the permissible() authorization cascade defect and upgrade to that release as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct immediate audit of all Author-role user accounts and restrict assignment to business-critical personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Ghost CMS versions 5.105.0-5.130.5 and 6.0.0-6.10.3 contain an authentication bypass in their two-factor authentication
Arbitrary code execution in Ghost CMS versions 0.7.2 through 6.19.0 allows authenticated attackers with theme upload pri
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitr
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any acco
Ghost before 5.82.0 allows CSV Injection during a member CSV export. Rated high severity (CVSS 8.8), this vulnerability
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external netw
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2
Ghost is a Node.js CMS. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication
Ghost is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely expl
Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.0.0 through 6.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today