CVE-2026-72596

CVE-2026-72596 is a broken access control in Ghost CMS where the Author role can delete any post on the platform, including posts they didn't author — not just their own. The root cause is a missing branch in Ghost's `permissible()` cascade, where the logic for checking whether an Author can destroy a post falls through to a permissive default instead of explicitly denying the action. This isn't an isolated coding error. It's the predictable consequence of an authorization architecture built on cascading permission checks that fall through to permissive defaults. Each new role, action, or relationship type added to Ghost's codebase extends this cascade without systematic testing of intersection cases. The fact that the isAuthor+isDestroy combination specifically fails — where the Author role can somehow delete other users' content — reveals the pattern: capabilities were added incrementally to solve immediate needs without revisiting the access control matrix. The cascade grew organically, and someone added the ability for Authors to delete posts without adding the corresponding branch in the permission logic. The deeper problem is structural, not procedural. When authorization depends on fallthrough logic rather than explicit deny-by-default, you're not writing secure code — you're writing code that appears secure until someone maps the gaps. The isAuthor capability to delete posts at all, particularly content they don't own, is itself a design red flag: that capability should never have existed in that role's permission surface. This vulnerability is one instance of a genetic sequence that spans PHP apps in 2008, Rails apps in 2012, Node apps in 2018, and Ghost in 2026 — the same cascade failure pattern recurring because the architectural choice keeps being made. The question isn't when this specific branch was lost — it's how many other fallthrough conditions are living in that cascade right now, undiscovered. Every new role, action, or relationship type added to Ghost inherits this same structural fragility. The CVE fixes the one hole we know about; it does nothing to the architecture that produces gaps systematically. For defenders: audit your Ghost deployment's role-permission matrix at the integration level, not just unit tests. Check whether any role has deletion capabilities that don't map cleanly to that role's intended function. More importantly, treat this CVE as evidence that cascade-based authorization has reached its complexity ceiling in your codebase. Policy-as-code frameworks with explicit deny-by-default semantics make this entire vulnerability class syntactically impossible — not just harder to find. The infinite maintenance burden of patching individual intersection cases will eventually exceed any team's capacity to keep up. This is the moment to invest in that migration.

Reviewed through automated stages and approved by a human before publication.