What’s Vulnerable › Vulnerabilities

CVE-2026-22595: Ghost has Staff Token permission bypass

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-10 · updated 2026-06-17
• Weakness: CWE-863

Description

Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.

Affected products

• TryGhost Ghost: from 5.121.0 before 5.130.6; from 6.0.0 before 6.11.0 — fixed in 5.130.6, 6.11.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 5.130.6, 6.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/TryGhost/Ghost/commit/9513d2a35c21067127ce8192443d8919ddcefcc8
• https://github.com/TryGhost/Ghost/commit/c3017f81a5387b253a7b8c1ba1959d430ee536a3
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-9xg7-mwmp-xmjx

Get alerted when CVE-2026-22595 or the next vulnerability affects your stack