CVE-2023-26510 Missing authorization in n/a
Contributors can view draft posts of other users, violating expected access controls, though the vendor disputes security impact.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-26510?
CVE-2023-26510 is a medium-severity missing authorization vulnerability in n/a, published on 5 Mar 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no security impact.
Weakness: CWE-862
Which versions are affected by CVE-2023-26510?
1 open source package ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.35.0 | 5.35.1 |
Products include Ghost Ghost.
How do I fix CVE-2023-26510?
Upgrade ghost to 5.35.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-26510 being exploited?
There is no known exploitation of CVE-2023-26510 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as BIT-ghost-2023-26510, GHSA-wx96-h8xj-9x6g.