CVE-2026-72596

Name of the Vulnerable Software and Affected Versions Ghost Foundation Ghost versions 5.x

Description An issue with broken access control allows authenticated users with the Author role to delete posts belonging to other users. This occurs because the permissible() function in the post model lacks a specific branch to handle the combined isAuthor and isDestroy conditions, which causes the authorization check to fail and permit the deletion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.