CVE-2026-72596highCWE-284

CVE-2026-72596: falha de alta gravidade em Ghost

Ghost Foundation Ghost - Broken Access Control

Publicada em

Seguir esta CVE+ Monitorar Ghost

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.4%
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Ghost Foundation · Ghost
CVEs relacionadas — Ghost

No mesmo produto, das mais perigosas para as menos.

CVE-2022-41697MEDIUMCVE-2022-41697EPSS 20.0%CVE-2022-41654CRITICALCVE-2022-41654EPSS 18.9%CVE-2022-47197CRITICALCVE-2022-47197EPSS 1.0%CVE-2022-47194CRITICALCVE-2022-47194EPSS 0.8%CVE-2024-34559HIGHWordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.7%CVE-2022-47196CRITICALCVE-2022-47196EPSS 0.7%