CVE-2026-22595

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-22595
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22595.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22595
Aliases
Published
2026-01-10T02:57:08.131Z
Modified
2026-01-15T05:55:56.974156Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Ghost has Staff Token permission bypass
Details

Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22595.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
5b8c97dcb46ae3d552a2f05531723f14c8f806a7
Fixed
67e137d8b0dd70cd5f486bfeea5d1643cee06104
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.11.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
9a3d66f39e6555123bbc17d8616aa1ce4ec93ca9
Fixed
a07c753c8a08c38d264b429b2a19873b152c097a
Database specific 
{
    "versions": [
        {
            "introduced": "5.121.0"
        },
        {
            "fixed": "5.130.6"
        }
    ]
}

Affected versions

v5.*

v5.121.0
v5.122.0
v5.123.0
v5.124.0
v5.125.0
v5.125.1
v5.126.0
v5.127.0
v5.127.1
v5.127.2
v5.128.0
v5.128.1
v5.129.0
v5.129.1
v5.129.2
v5.130.0
v5.130.1
v5.130.2
v5.130.3
v5.130.4
v5.130.5

v6.*

v6.0.0
v6.0.1
v6.0.10
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.0.9
v6.1.0
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.2.0
v6.3.0
v6.3.1
v6.4.0
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0
v6.7.0
v6.8.0
v6.8.1
v6.9.0
v6.9.1
v6.9.2
v6.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22595.json"