CVE-2023-26510

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no...

CVE-2023-26510

Ghost 5.35.0 exposes an authorization bypass where contributors can view draft posts of other users. The root cause is described as improper authorization management, with the vendor stating this behavior has no security impact. Documented sources from Red Hat, OSV, PT Security, PRION, and NVD co...

CVE-2023-26510

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no...