CyberRota Analysis
AI-GeneratedA broken access control vulnerability in Ghost 5.x allows authenticated Author-role users to delete posts created by other users due to a flaw in the authorization checks. This oversight can lead to unauthorized content deletion, potentially disrupting user trust and platform integrity. Organizations using Ghost 5.x should prioritize addressing this issue to prevent abuse by compromised or malicious Author accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.