Access Control Flaw in Ghost Foundation Ghost 5.x Allows Unauthorized Post Deletions
CVE-2026-72596

8.1HIGH

Key Information:

Vendor

Ghost Foundation

Status
Ghost
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72596?

A broken access control vulnerability in Ghost Foundation's Ghost 5.x enables authenticated users with the Author role to delete posts that they do not own. This occurs due to a missing check in the post model's authorization cascade, allowing the system to overlook the necessary permissions for deletion under certain conditions. An attacker with an Author account could exploit this flaw to remove any post from the platform without proper authorization.

Affected Version(s)

Ghost 0 <= 5.x

References

https://github.com/TryGhost/Ghost

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.