Ghost, a Node.js based content management system, suffered an authorization flaw that allows users with the Author role to delete posts and pages that they did not author. This flaw permits the removal of content not owned by the user, compromising the integrity of published material.

The affected product is Ghost by TryGhost. Versions from 5.81.0 up to, but not including, 6.60.0 are vulnerable. Version 6.60.0 or later contains the fix.

The CVSS score of 6.5 indicates moderate severity. No EPSS data is available and the issue is not listed in CISA KEV, suggesting limited public exploitation. The exploit requires a valid authenticated session with an Author role and can be performed through normal CMS interactions without additional attack traffic. The primary risk is the accidental or intentional deletion of site content by users who should not have that capability.