This vulnerability arises from improper access control in Ghost Foundation Ghost 5.x where the post model's permissible() function lacks handling for the combined isAuthor and isDestroy condition. As a result, the authorization check fails to prevent Author-role users from deleting posts they do not own. An attacker with an Author account can exploit this to delete any post on the platform, impacting data integrity and availability.

The vulnerability allows an authenticated user with Author role privileges to delete posts owned by other users, leading to unauthorized data modification and potential denial of service by removing content. There is no impact on confidentiality reported. The CVSS 3.1 score is 8.1 (High), reflecting high impact on integrity and availability with network attack vector and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict Author role assignments to trusted users only and monitor for suspicious deletion activity.