BIT-ghost-2026-105680

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105680.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-ghost-2026-105680

Aliases

Published

2026-10-13T06:50:32Z

Modified

2026-10-13T08:25:39Z

Summary

Ghost: Authorization Issue Allowed Author Role to Delete any Post

Details

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / ghost

Package

Name: ghost
Purl: pkg:bitnami/ghost

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

5.81.0

Fixed

6.60.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105680.json"