CVE-2026-22596: Ghost SQL Injection Vulnerability in Members Activity Feed
Summary
CVE-2026-22596: Ghost has SQL Injection in Members Activity Feed. Affects ghost across 2 version ranges.
>= 5.105.0, < 5.130.6
>= 6.0.0, < 6.11.0
Fixed in 5.130.6 or 6.11.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It provides a user-friendly interface for bloggers and publishers, enabling them to create, edit, and manage posts easily. The platform is built on Node.js and utilizes a modern JavaScript stack, making it highly extensible and customizable. However, a recent vulnerability has been identified in the Ghost API, specifically in the members' activity feed, which could allow unauthorized SQL execution.
Vulnerability Detail
The vulnerability exists in the Ghost API endpoint '/ghost/api/admin/members/events', where authenticated users with Admin API credentials can exploit the system to execute arbitrary SQL commands. This SQL injection flaw can lead to unauthorized data access, data manipulation, or even complete database compromise, depending on the attacker's intent and the database's configuration. The vulnerability affects versions of Ghost from v5.90.0 to v5.130.5 and v6.0.0 to v6.10.3.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.105.0, < 5.130.65.130.6npm install ghost@5.130.6 -
>= 6.0.0, < 6.11.06.11.0npm install ghost@6.11.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the Admin API for untrusted users until the package is updated. This can be done by implementing stricter authentication and authorization checks in your application.
Conclusion
The SQL injection vulnerability in Ghost's Members Activity Feed poses a significant risk to users with Admin API access. It is crucial to update to the latest patched versions to safeguard your application from potential attacks. Implementing additional security measures can also help mitigate risks until the update is applied.
See every vulnerability recorded for ghost →
FAQ
The vulnerability is an SQL injection flaw that allows authenticated users to execute arbitrary SQL commands through the Ghost API.
Ghost versions from v5.90.0 to v5.130.5 and v6.0.0 to v6.10.3 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you in real-time about vulnerabilities. You can also check your application using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, consider restricting access to the Admin API and implementing additional security measures to mitigate the risk.
The CVSS score for this vulnerability is 6.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
