CVE-2026-105680

MEDIUMCVSS 6.5

Description

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165
https://github.com/TryGhost/Ghost/issues/30283
https://github.com/TryGhost/Ghost/releases/tag/v6.60.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562

Source: NIST NVD · Data may lag official sources by up to one minute