CVE-2026-105680

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165
• https://github.com/TryGhost/Ghost/issues/30283
• https://github.com/TryGhost/Ghost/releases/tag/v6.60.0
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562

Check your stackJSON