← Database

CVE-2026-22596

MEDIUM CVSS: 6.7 Published: 2026-01-10 Modified: 2026-06-17

Description

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

Affected Platforms

Ghost Ghost

Weakness Type

CWE-89

References