Authentication Bypass in Ghost CMS Affects User Access Control
CVE-2026-22595
8.1HIGH
What is CVE-2026-22595?
Ghost, a popular Node.js content management system, has a vulnerability that affects specific versions, allowing unauthorized access to endpoints meant only for Staff Session authentication. This issue arises from the way Ghost handles Staff Token authentication, potentially granting external systems authenticated as Admin or Owner users inappropriate access. The vulnerability has been addressed in subsequent updates, and users are strongly advised to upgrade to versions 5.130.6 and 6.11.0 or later to ensure system security.
Affected Version(s)
Ghost >= 6.0.0, < 6.11.0 < 6.0.0, 6.11.0
Ghost >= 5.121.0, < 5.130.6 < 5.121.0, 5.130.6