CVE-2026-105680

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105680
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105680.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105680
Aliases
Downstream
Published
2026-10-05T19:24:51Z
Modified
2026-10-28T02:30:21Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Details

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105680.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
5d714f8a05b399dc0dd2e8a2947fe61634650221
Fixed
431d483b26fc62749611536dfb54fa1bac4ae06a
Fixed
cf2f718a67faa342c27989b701554ddd63862165
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "5.81.0"
                },
                {
                    "fixed":  "6.60.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "cf2f718a67faa342c27989b701554ddd63862165"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v6.60.0",
            "range":  [
                {
                    "fixed":  "431d483b26fc62749611536dfb54fa1bac4ae06a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v5.*
v5.100.0
v5.101.0
v5.101.4
v5.101.6
v5.102.0
v5.103.0
v5.104.0
v5.105.0
v5.106.0
v5.106.1
v5.107.0
v5.108.0
v5.108.1
v5.109.0
v5.109.3
v5.109.6
v5.110.0
v5.110.2
v5.111.0
v5.112.0
v5.113.0
v5.114.0
v5.115.1
v5.116.0
v5.116.2
v5.117.0
v5.118.0
v5.118.1
v5.119.0
v5.119.2
v5.120.0
v5.120.2
v5.121.0
v5.122.0
v5.125.1
v5.126.0
v5.127.0
v5.127.1
v5.128.0
v5.129.0
v5.129.1
v5.129.2
v5.130.0
v5.130.1
v5.81.0
v5.81.1
v5.82.0
v5.82.1
v5.82.11
v5.82.12
v5.82.2
v5.82.3
v5.82.4
v5.82.6
v5.82.9
v5.83.0
v5.84.0
v5.84.1
v5.84.2
v5.85.0
v5.85.1
v5.86.0
v5.86.1
v5.86.2
v5.87.0
v5.87.1
v5.87.2
v5.88.0
v5.88.1
v5.88.2
v5.89.0
v5.89.1
v5.89.2
v5.90.0
v5.91.0
v5.92.0
v5.93.0
v5.94.0
v5.94.1
v5.94.2
v5.95.0
v5.96.0
v5.96.1
v5.97.0
v5.98.0
v5.99.0
v6.*
v6.0.0
v6.0.0-alpha.2
v6.0.0-rc.0
v6.0.0-rc.1
v6.0.0-rc.2
v6.0.0-rc.3
v6.0.1
v6.0.10
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.1.0
v6.10.0
v6.10.3
v6.11.0
v6.12.0
v6.13.0
v6.13.1
v6.13.2
v6.14.0
v6.15.0
v6.16.0
v6.16.1
v6.17.0
v6.17.1
v6.18.0
v6.18.2
v6.19.0
v6.19.1
v6.19.2
v6.19.3
v6.19.4
v6.2.0
v6.20.0
v6.20.1
v6.21.0
v6.21.1
v6.21.2
v6.22.0
v6.22.1
v6.23.0
v6.24.0
v6.25.0
v6.25.1
v6.26.0
v6.27.0
v6.28.0
v6.29.0
v6.29.1
v6.3.0
v6.3.1
v6.30.0
v6.31.0
v6.32.0
v6.33.0
v6.34.0
v6.35.0
v6.36.0
v6.37.0
v6.37.1
v6.38.0
v6.39.0
v6.4.0
v6.40.0
v6.41.0
v6.41.1
v6.42.0
v6.43.0
v6.43.1
v6.44.0
v6.44.1
v6.45.0
v6.46.0
v6.47.0
v6.48.0
v6.49.0
v6.5.0
v6.5.2
v6.5.3
v6.50.0
v6.51.0
v6.52.0
v6.52.1
v6.53.0
v6.54.0
v6.54.1
v6.55.0
v6.56.0
v6.57.0
v6.57.1
v6.58.0
v6.59.0
v6.6.0
v6.7.0
v6.8.0
v6.8.1
v6.9.0
v6.9.2
v6.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105680.json"