CVE-2026-105680 TryGhost CVE debrief

Who should care

System administrators and Ghost users with the Author role should assess exposure and prioritize updating vulnerable instances. This includes reviewing current Ghost deployments, identifying instances with users in the Author role, and ensuring that these instances are updated to version 6.60.0 or later. Additionally, defenders should verify post deletion functionality after updates and review logs for suspicious activity.

Why it matters

CVE-2026-105680 allows Author role users in Ghost to delete posts and pages they did not author. System administrators and Ghost users with the Author role should assess exposure and prioritize updating vulnerable instances.

• Author role users can delete unauthorized posts and pages
• Requires verification of affected versions and instance updates
• Prioritize updating vulnerable Ghost instances
• Defenders should verify post deletion functionality after updates

Technical summary

A vulnerability in Ghost allows users with the Author role to delete posts and pages they did not author. This issue exists from version 5.81.0 up to 6.60.0. The fix is included in version 6.60.0. This vulnerability is a result of insufficient authorization checks, allowing Author role users to perform actions beyond their intended permissions. Technical details include the need to update affected instances to prevent unauthorized post deletion and ensure data integrity. Defenders should focus on updating vulnerable instances and verifying the effectiveness of the update.

Defensive priority

Medium

Recommended defensive actions

• Update Ghost to version 6.60.0 or later
• Assess exposure for Ghost instances with users in the Author role
• Verify instance updates and test post deletion functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows users with the Author role to delete posts and pages they did not author. This issue is present in Ghost from version 5.81.0 up to 6.60.0. The fix is included in version 6.60.0. Evidence of this vulnerability includes instances where Author role users have deleted unauthorized posts or pages. Defenders should verify post deletion functionality after updates and review logs for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.