{"id":"EUVD-2026-92771","enisaUuid":"959d7b95-f41f-3120-9741-8861f9cd5eba","description":"Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.","datePublished":"Oct 5, 2026, 7:24:51 PM","dateUpdated":"Oct 6, 2026, 4:51:07 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562\nhttps://github.com/TryGhost/Ghost/issues/30283\nhttps://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.60.0\n","aliases":"CVE-2026-105680\nGHSA-x3mg-q38v-m562\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"29432a4e-ea4d-38ac-a111-c2fb678e9cd5","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.81.0, \u003c 6.60.0"}],"enisaIdVendor":[{"id":"98790f5e-b193-3df6-8f99-47f18059d0cd","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"020d67d8-47db-3994-958f-5bd3b7d1da71","vulnerability":{"id":"GHSA-x3mg-q38v-m562","description":"Ghost: Authorization Issue Allowed Author Role to Delete any Post","datePublished":"Oct 7, 2026, 6:05:32 PM","dateUpdated":"Oct 7, 2026, 6:05:32 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105680\nhttps://github.com/TryGhost/Ghost/issues/30283\nhttps://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.60.0\n","enisa_id":"EUVD-2026-92771\n","aliases":"CVE-2026-105680\nGHSA-x3mg-q38v-m562\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"771410f6-4c7e-3901-9d9a-ca6958a2bd61","vulnerability":{"id":"CVE-2026-105680","description":"Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.","datePublished":"Oct 5, 2026, 7:24:51 PM","dateUpdated":"Oct 6, 2026, 4:51:07 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562\nhttps://github.com/TryGhost/Ghost/issues/30283\nhttps://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.60.0\n","enisa_id":"EUVD-2026-92771\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 4, 2026, 7:15:38 AM","vulnerabilityProduct":[{"id":"b552e1d9-198a-39ad-b789-ebefca1ce756","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.81.0, \u003c 6.60.0"}],"vulnerabilityVendor":[{"id":"5aa5a5c9-2d15-3e74-8eb7-1cc8991da878","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}