EUVD-2026-56035
GHSA-x7gh-ph2w-vvr2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable via standard Admin API; Author-role account (PR:L) required; no confidentiality impact; irreversible post deletion yields high integrity and availability loss.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.
AnalysisAI
Broken access control in Ghost Foundation Ghost 5.x enables any authenticated Author-role user to delete posts owned by other users, including content published by Editors and Administrators. The authorization failure originates in the post model's permissible() cascade, where the combined isAuthor-and-isDestroy condition is not handled, causing the guard to fall through and approve the deletion. No public exploit code has been identified at time of analysis, but the low attack complexity and minimal privilege requirement mean the flaw is trivially abusable by any Author-role account holder on the platform.
Technical ContextAI
Ghost is an open-source Node.js CMS (CPE: cpe:2.3:a:ghost_foundation:ghost:*:*:*:*:*:*:*:*) that enforces content permissions through a role-action permissible() authorization cascade in its post model. The vulnerability maps to CWE-284 (Improper Access Control): the cascade correctly handles individual conditions such as isAuthor and isDestroy in isolation, but lacks the compound branch covering the simultaneous case where the acting user holds the Author role and the requested operation is a destroy/delete. When both conditions are true, the cascade falls through to a permissive default, and the delete request is executed without an ownership check. This is a coverage gap in a multi-condition access control decision tree - a structurally common manifestation of CWE-284 where developers enumerate role-action combinations incompletely.
RemediationAI
No specific patched version was confirmed in the available intelligence - operators should monitor the Ghost GitHub repository at https://github.com/TryGhost/Ghost for a release that addresses the permissible() authorization cascade defect and upgrade to that release as the primary remediation. Until a confirmed patch is available, the most effective compensating control is to audit and demote Author-role accounts: Ghost's Contributor role cannot publish or delete content, so demoting Author accounts to Contributor prevents exploitation at the cost of requiring Editors to publish on Authors' behalf. Operators who cannot tolerate the workflow disruption of role demotion should restrict new Author account creation to fully trusted individuals and enable Ghost's built-in activity logging to detect anomalous delete events via the Admin API. Backup cadence should be increased immediately to reduce the blast radius of any unauthorized post deletions that may occur before patching.
Ghost CMS versions 5.105.0-5.130.5 and 6.0.0-6.10.3 contain an authentication bypass in their two-factor authentication
Arbitrary code execution in Ghost CMS versions 0.7.2 through 6.19.0 allows authenticated attackers with theme upload pri
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitr
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary
SQL injection in Ghost CMS versions 3.24.0 through 6.19.0 allows unauthenticated attackers to read arbitrary database da
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any acco
Ghost before 5.82.0 allows CSV Injection during a member CSV export. Rated high severity (CVSS 8.8), this vulnerability
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external netw
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2
Ghost is a Node.js CMS. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication
Ghost is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely expl
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today