p PatchFirst

CVE-2026-22595

CVE-2026-22595 · Ghost has Staff Token permission bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.

CVSS 8.1 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • >= 6.0.0, < 6.11.0: Affected
    • >= 5.121.0, < 5.130.6: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 6.0.0, < 6.11.0

    Update to 6.11.0

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 5.105.0, < 5.130.6

    Update to 5.130.6

Original sources

Check your server →