CVE-2026-26980

7.5 highEPSS 71%

High (7.5) in ghost ghost. EPSS 71% chance of exploitation in the next 30 days. Fixed in ghost 6.19.1.

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 71% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ghost:ghost

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-w52v-v783-gw97	npm	ghost	>=3.24.0 <6.19.1	6.19.1

References

https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91
https://github.com/TryGhost/Ghost/releases/tag/v6.19.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97
https://blog.xlab.qianxin.com/ghost-cms-page-poisoning-cve-2026-26980/

Check your stack JSON