CVE-2026-72596
Last modified
CVE-2026-72596 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Ghost Foundation | Ghost | <= 5.x |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-72596?
How severe is CVE-2026-72596?
How do I fix CVE-2026-72596?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-72590An OS command injection vulnerability in alseambusher/cronta…9.8
- CVE-2026-72591A server-side request forgery (SSRF) vulnerability in gabehf…7.7
- CVE-2026-72592An unrestricted file upload vulnerability in dulldusk/phpfm …9.8
- CVE-2026-72593A missing authentication vulnerability in dulldusk/phpfm thr…9.8
- CVE-2026-72594A stored cross-site scripting (XSS) vulnerability in lobehub…7.6
- CVE-2026-72595A broken access control vulnerability in BadChoice Handesk a…8.1
- CVE-2026-72597A server-side request forgery vulnerability in Friendica thr…6.5
- CVE-2026-72598A server-side request forgery vulnerability in Apioo Fusio 8…6.5
- CVE-2026-72599An SQL injection vulnerability in e107 2.4.0 allows unauthen…9.8
- CVE-2026-7260Circular symbolic links in phar archives could lead to unbou…5.5
- CVE-2026-72600A broken access control vulnerability in Idurar IDURAR ERP C…7.5
- CVE-2026-72601A broken access control vulnerability in CSZ CMS 1.3.2 allow…7.5
Are you affected by CVE-2026-72596?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST