Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-105680 · GHSA-x3mg-q38v-m562

Ghost: Authorization Issue Allowed Author Role to Delete any Post

Risk score
48/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
Affected
ghost (npm) >= 5.81.0, < 6.60.0
Fix
Upgrade ghost to 6.60.0 or later.
Exploitation
No known exploitation

Story map

Story map: ghostTHE FLAWSTHE FIXCVE-2026-105680Ghost: Authorization IssueAllowed Author Role to Deleteany PostCVSS 6.5 · EPSS 0%CVE-2026-105642Ghost: Remote Code Executionvia Bookmark Card ImagesCVSS 8.8 · EPSS 0%CVE-2026-105650Ghost: Stored XSS via oEmbedPhoto ResponsesCVSS 8.1 · EPSS 0%CVE-2026-105677Ghost: Remote Code Executionvia Theme Translation FilesCVSS 7.2 · EPSS 1%Upgrade ghost6.60.0 · 6.67.0 · 6.64.0or later on your release lineWho is exposedghost (npm) >= 6.56.0, < 6.67.0AMBER · PATCH THIS WEEKghostGhost is a Node.js contentmanagement system. From6.56.0 until 6.67.0, an imageprocessing library bundled withGhost contained a vulnerabilityin its SVG handling. Any staffuser, including Contributors…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authorisation (CWE-862)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…

The flaws

  • CVE-2026-105680: Ghost: Authorization Issue Allowed Author Role to Delete any Post (CVSS 6.5 · EPSS 0%)
  • CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
  • CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
  • CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)

The fix

Upgrade ghost: 6.60.0 · 6.67.0 · 6.64.0 or later on your release line

Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ghostnpm>= 5.81.0, < 6.60.06.60.0

References

Original description

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.