CVE-2026-26980

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Score

CVSS 3.1 9.4 Critical

Status

Modified - security-advisories@github.com

Published

2026-02-20

Last modified

2026-05-26

Weaknesses

CWE-89

Affected products

• Ghost (Ghost)
• Ghost (Tryghost)

References

• https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91
• https://github.com/TryGhost/Ghost/releases/tag/v6.19.1
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97
• https://blog.xlab.qianxin.com/ghost-cms-page-poisoning-cve-2026-26980/