CVE-2026-72596: Ghost Foundation Ghost - Broken Access Control
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72596?
The severity of CVE-2026-72596 is high, rated at 8.1.
How does CVE-2026-72596 affect Ghost Foundation Ghost users?
CVE-2026-72596 allows authenticated Author-role users to delete posts owned by other users due to broken access control.
What are the impacts of CVE-2026-72596 on data integrity?
CVE-2026-72596 can lead to unauthorized deletion of posts, compromising data integrity within the Ghost platform.
How can I remediate CVE-2026-72596?
To fix CVE-2026-72596, update to the latest version of Ghost Foundation Ghost that addresses the broken access control vulnerability.
Who is affected by CVE-2026-72596?
Authenticated users with Author roles in Ghost Foundation Ghost 5.x are affected by CVE-2026-72596.