Ghost has Staff Token permission bypass_CVE-2026-22595

8.1 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Description

Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.

Basic Information

ID CVE-2026-22595

Source GitHub_M

Published Jan 10, 2026 at 02:57

Affected Product

Vendor TryGhost

Product Ghost

Version >= 6.0.0, < 6.11.0

Affected Versions TryGhost Ghost >= 6.0.0, < 6.11.0
TryGhost Ghost >= 5.121.0, < 5.130.6

CWE Classification

CWE-863

References

{
    "lastseen": "",
    "description": "Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.",
    "published": "2026-01-10T02:57:08.131Z",
    "modified": "2026-01-10T02:57:08.131Z",
    "type": "cve",
    "title": "Ghost has Staff Token permission bypass",
    "source": "GitHub_M",
    "references": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-9xg7-mwmp-xmjx\nhttps://github.com/TryGhost/Ghost/commit/9513d2a35c21067127ce8192443d8919ddcefcc8\nhttps://github.com/TryGhost/Ghost/commit/c3017f81a5387b253a7b8c1ba1959d430ee536a3",
    "id": "CVE-2026-22595",
    "bulletinFamily": "",
    "cwe": [
        "CWE-863"
    ],
    "cvelist": null,
    "sourceData": "TryGhost Ghost >= 6.0.0, < 6.11.0\nTryGhost Ghost >= 5.121.0, < 5.130.6",
    "sourceHref": "",
    "cvss": {
        "score": 8.1,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Ghost",
    "version": ">= 6.0.0, < 6.11.0",
    "vendor": "TryGhost",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}