CVE-2026-22596

Medium

Published: 10 January 2026

Published

10 January 2026

Modified

15 January 2026

KEV Added

—

Patch

—

CVSS Score 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

EPSS Score 0.0012 30.4th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22596 is a medium-severity SQL Injection (CWE-89) vulnerability in Ghost Ghost. Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing Ghost Admin API endpoint directly matches exploitation of web application flaws for arbitrary query execution and data impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched…

in versions 5.130.6 and 6.11.0.

Deeper analysisAI

CVE-2026-22596 is a SQL injection vulnerability (CWE-89) in Ghost, a Node.js content management system. The flaw affects versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, specifically in the /ghost/api/admin/members/events endpoint of the Admin API. It enables arbitrary SQL execution when the endpoint processes untrusted input from authenticated requests.

Attackers require valid authentication credentials for the Ghost Admin API, corresponding to high privileges (PR:H) as per the CVSS v3.1 base score of 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L). Exploitation occurs over the network with low complexity and no user interaction. Successful attacks allow high-impact confidentiality and integrity violations, such as data exfiltration or modification, alongside low availability disruption.

Ghost has addressed the issue in patched versions 5.130.6 and 6.11.0. The official security advisory (GHSA-gjrp-xgmh-x9qq) and related commits detail the fixes, recommending immediate upgrades for affected installations.