CVE-2026-22596

MEDIUM

6.7

Descripcion

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

Detalles CVE

Puntuacion CVSS v3.16.7

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado1/10/2026

Ultima modificacion1/15/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

ghost:ghost

Debilidades (CWE)

CWE-89

Referencias

https://github.com/TryGhost/Ghost/commit/cda236e455a7a30e828b6cba3c430e5796ded955(security-advisories@github.com)

https://github.com/TryGhost/Ghost/commit/f2165f968bcdaae0e35590b38fa280ab03239391(security-advisories@github.com)

https://github.com/TryGhost/Ghost/security/advisories/GHSA-gjrp-xgmh-x9qq(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.