🚨High - Ghost Broken Access Control Lets Any Author Delete Any Post (CVE-2026-72596) Ghost 5.x contains a broken access control flaw in the post model's permissible() logic. The cascade is missing the branch handling the combined isAuthor + isDestroy condition, so the authorization check falls through and allows the delete. As a result, an authenticated user with only the Author role can delete any post on the site, not just their own. There's no code execution or data disclosure here - the impact is integrity and availability (content deletion). The real risk is multi-author Ghost publications where Authors are lower-trust; single-author sites aren't meaningfully exposed. CVSS 8.1. 👉Restrict Author accounts to trusted users and watch for a patched Ghost release.
Post summary
The post describes a Ghost 5.x broken access control flaw (CVE-2026-72596) that lets any author delete any post, includes technical details and CVSS, but no PoC or active exploitation reports, and recommends restricted author accounts and awaiting a patch.