CVE-2026-22596CWE-89

Ghost has SQL Injection in Members Activity Feed

Medium · published January 10, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-10T02:57Z
EPSS history
Timeline
  • 10 JAN 02:57Z
    Ghost has SQL Injection in Members Activity Feed
    cvelistv5