CVE-2026-72596
Received Received - Intake

Broken Access Control in Ghost CMS Allows Post Deletion

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72596
EUVD
EUVD-2026-56035

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ghost_foundation ghost 5.x
ghost_foundation ghost 5.*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a broken access control vulnerability in Ghost Foundation Ghost 5.x where authenticated Author-role users can delete posts owned by other users. The issue occurs because the post model's authorization check fails to handle the combined condition for deletion, allowing unauthorized access.

Detection Guidance

This vulnerability requires checking Ghost's access control implementation for the Author role's ability to delete posts owned by others. Review Ghost's post deletion logic in the codebase, particularly the permissible() cascade function, to confirm if isAuthor and isDestroy conditions are properly handled. No direct network or system commands are provided in the context to detect this issue.

Impact Analysis

An attacker with an Author account could delete any post on the platform, leading to data loss, disruption of services, or unauthorized content removal. This could affect the integrity and availability of published content.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized deletion of user-generated content, potentially violating data integrity and availability requirements in GDPR and HIPAA. Unauthorized data loss may lead to regulatory penalties.

Mitigation Strategies

Update Ghost to the latest version to patch the broken access control vulnerability. Restrict Author-role users to only manage their own posts and review user permissions to ensure no unauthorized access is possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart