CVE-2026-72596

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.

• CWE-284

• https://github.com/TryGhost/Ghost

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72590An OS command injection vulnerability in alseambusher/cronta…9.8
• CVE-2026-72591A server-side request forgery (SSRF) vulnerability in gabehf…7.7
• CVE-2026-72592An unrestricted file upload vulnerability in dulldusk/phpfm …9.8
• CVE-2026-72593A missing authentication vulnerability in dulldusk/phpfm thr…9.8
• CVE-2026-72594A stored cross-site scripting (XSS) vulnerability in lobehub…7.6
• CVE-2026-72595A broken access control vulnerability in BadChoice Handesk a…8.1
• CVE-2026-72597A server-side request forgery vulnerability in Friendica thr…6.5
• CVE-2026-72598A server-side request forgery vulnerability in Apioo Fusio 8…6.5
• CVE-2026-72599An SQL injection vulnerability in e107 2.4.0 allows unauthen…9.8
• CVE-2026-7260Circular symbolic links in phar archives could lead to unbou…5.5
• CVE-2026-72600A broken access control vulnerability in Idurar IDURAR ERP C…7.5
• CVE-2026-72601A broken access control vulnerability in CSZ CMS 1.3.2 allow…7.5