Vulnerability in Ghost Foundation
CVE-2026-72596
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor…
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Ghost Foundation — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-72596?
- CVE-2026-72596 is a high-severity vulnerability in Ghost Foundation, classified under Improper Access Control. CVSS score: 8.1/10. Published 2026-08-11.
- How severe is CVE-2026-72596?
- High severity. CVSS v3 base score is 8.1 out of 10.