CVE-2026-105680

EUVD-2026-92771
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165
https://github.com/TryGhost/Ghost/issues/30283
https://github.com/TryGhost/Ghost/releases/tag/v6.60.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562