This vulnerability is a broken access control flaw in Ghost Foundation Ghost that permits any authenticated user with an Author role to delete posts created by other users. The flaw results from a missing branch in the post model’s permissible() cascade for the combined conditions of isAuthor and isDestroy, causing the authorization check to fall through and incorrectly allow the deletion operation. This flaw is classified as CWE-284, reflecting a failure to enforce proper access controls. The primary impact is the irreversible loss of content, which undermines data confidentiality and integrity for the affected users.

Ghost Foundation Ghost version 5.x is affected by the described flaw. Users running any 5.x release are at risk if they have AUTHORIZED Author accounts. No other Ghost or Ghost Foundation products are listed as impacted.

The CVSS score of 8.1 marks this as a high severity issue, corroborating the malicious capability of unwanted content removal. EPSS is not available, so there is no published probability metric; however, the vulnerability can be exploited by any user who has been granted or compromised an Author role, which is a common and reachable privilege level in most Ghost deployments. The vulnerability is not listed in KEV, but the potential for widespread social or business impact suggests that monitoring and timely patching are critical.