CVE-2026-22596

Description

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

PUBLISHED Reserved 2026-01-07 | Published 2026-01-10 | Updated 2026-01-12 | Assigner GitHub_M

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

References

github.com/.../Ghost/security/advisories/GHSA-gjrp-xgmh-x9qq

github.com/...ommit/cda236e455a7a30e828b6cba3c430e5796ded955

github.com/...ommit/f2165f968bcdaae0e35590b38fa280ab03239391

cve.org (CVE-2026-22596)

nvd.nist.gov (CVE-2026-22596)

Download JSON