CVE-2026-105680: Ghost Package Authorization Flaw Allows Author Role to Delete Any Post
Summary
CVE-2026-105680: Ghost: Authorization Issue Allowed Author Role to Delete any Post. Affects ghost versions >= 5.81.0, < 6.60.0. Fixed in 6.60.0. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-105680 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It is built on Node.js and provides a user-friendly interface for bloggers and publishers. The platform supports various features such as customizable themes, SEO optimization, and membership management. However, a recent vulnerability has been identified that affects the authorization controls within the system, allowing users with the Author role to delete posts they did not create.
Vulnerability Detail
The vulnerability arises from improper authorization checks within the Ghost application. Specifically, staff members assigned the Author role are able to delete posts and pages that they did not author. This flaw can lead to unauthorized content removal, potentially disrupting the integrity of the website and affecting user trust. The issue is present in Ghost versions from 5.81.0 up to 6.60.0, and it has been classified under CWE-862, indicating a lack of proper access control.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.60.0
This is the first release that contains the fix.
npm install ghost@6.60.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict the Author role's permissions until the update can be applied. This can be done by modifying user roles and permissions in the Ghost admin settings to prevent Authors from having delete access.
Conclusion
The CVE-2026-105680 vulnerability in the Ghost package poses a significant risk by allowing unauthorized deletion of posts by users with the Author role. It is crucial for users to update to version 6.60.0 or later to mitigate this risk and maintain the integrity of their content management system.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-105680 is a vulnerability in the Ghost package that allows users with the Author role to delete posts they did not create.
The vulnerability affects Ghost versions from 5.81.0 up to 6.60.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
To update your Ghost installation, follow the instructions for your setup: use 'docker pull ghost' for Docker installations or refer to the Ghost-CLI documentation for other setups.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
