CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HCVE-2026-22595
High (8.1) in ghost ghost. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in ghost 5.130.6, 6.11.0.
Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ghost:ghost
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9xg7-mwmp-xmjx | npm | ghost | >=6.0.0 <6.11.0 | 6.11.0 |
| GHSA-9xg7-mwmp-xmjx | npm | ghost | >=5.105.0 <5.130.6 | 5.130.6 |