CVE-2026-22595: Ghost has Staff Token permission bypass

Published Jan 8, 2026
·
Updated

Impact A vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints.

Vulnerable versions This vulnerability is present in Ghost v5.121.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.

Patches v5.130.6 and v6.11.0 contain a fix for this issue.

References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.

For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.

Other sources

Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.

— MITRE

Affected Software

4 affected componentsFixes available
npm/ghost>=5.105.0<=5.130.5
5.130.6
npm/ghost>=6.0.0<=6.10.3
6.11.0
Ghost Ghost Node.js>=5.121.0<5.130.6
Ghost Ghost Node.js>=6.0.0<6.11.0

Remediation

Patch Available

https://github.com/TryGhost/Ghost/commit/9513d2a35c21067127ce8192443d8919ddcefcc8

Patch Available

https://github.com/TryGhost/Ghost/commit/c3017f81a5387b253a7b8c1ba1959d430ee536a3

Patch Available

https://github.com/TryGhost/Ghost/security/advisories/GHSA-9xg7-mwmp-xmjx

Event History

Jan 8, 2026
Advisory Published
via GitHub·09:32 PM
Data Sourced
via GitHub·09:32 PM
DescriptionSeverityWeaknessAffected Software
Jan 10, 2026
CVE Published
via MITRE·02:57 AM
Data Sourced
via MITRE·02:57 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 28, 58065
Event
via FIRST·02:25 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-22595?

CVE-2026-22595 is classified as a high severity vulnerability that affects Ghost CMS implementations.

2

How do I fix CVE-2026-22595?

To fix CVE-2026-22595, upgrade to Ghost version 5.130.6 or 6.11.0 immediately.

3

What versions of Ghost are affected by CVE-2026-22595?

CVE-2026-22595 affects Ghost versions from 5.105.0 to 5.130.5 and 6.0.0 to 6.10.3.

4

What specific issue does CVE-2026-22595 address?

CVE-2026-22595 addresses a flaw in Ghost's handling of Staff Token authentication that could grant unauthorized access to certain endpoints.

5

Who is at risk due to CVE-2026-22595?

External systems authenticated via Staff Tokens for Admin or Owner-role users are at risk due to CVE-2026-22595.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203