Cyber Resilience

CVE-2026-22596

Medium

Published: 10 January 2026

Published
10 January 2026
Modified
15 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0005 16.3th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22596 is a medium-severity SQL Injection (CWE-89) vulnerability in Ghost Ghost. Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-22596 is a SQL injection vulnerability (CWE-89) in Ghost, a Node.js content management system. The flaw affects versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, specifically in the /ghost/api/admin/members/events endpoint of the Admin API. It enables arbitrary SQL execution when the endpoint processes untrusted input from authenticated requests.

Attackers require valid authentication credentials for the Ghost Admin API, corresponding to high privileges (PR:H) as per the CVSS v3.1 base score of 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L). Exploitation occurs over the network with low complexity and no user interaction. Successful attacks allow high-impact confidentiality and integrity violations, such as data exfiltration or modification, alongside low availability disruption.

Ghost has addressed the issue in patched versions 5.130.6 and 6.11.0. The official security advisory (GHSA-gjrp-xgmh-x9qq) and related commits detail the fixes, recommending immediate upgrades for affected installations.

EU & UK References

Vulnerability details

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched…

more

in versions 5.130.6 and 6.11.0.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing Ghost Admin API endpoint directly matches exploitation of web application flaws for arbitrary query execution and data impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-26980Same product: Ghost Ghost
CVE-2026-29784Same product: Ghost Ghost
CVE-2026-22595Same product: Ghost Ghost
CVE-2026-22594Same product: Ghost Ghost
CVE-2026-29053Same product: Ghost Ghost
CVE-2026-24778Same product: Ghost Ghost
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89

Affected Assets

ghost
ghost
5.90.0 — 5.130.6 · 6.0.0 — 6.11.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of untrusted input to the /ghost/api/admin/members/events endpoint, blocking the SQL injection that enables arbitrary SQL execution.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of patches (5.130.6/6.11.0) that remediate the SQL injection flaw in the Admin API endpoint.

AC-6 Least Privilege partial match
prevent

Restricts the number of accounts holding the high-privilege Admin API credentials required to reach the vulnerable endpoint.

References