CVE-2026-26980

Published Feb 20, 2026

Last updated 12 days ago

SQL injection

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-26980 is a SQL injection vulnerability found in Ghost, a Node.js content management system. This flaw specifically affects the Content API's slug filter ordering functionality. It allows unauthenticated attackers to perform arbitrary reads from the database. The vulnerability impacts Ghost versions 3.24.0 through 6.19.0. Exploitation of this issue could lead to the extraction of sensitive data, including user credentials, authentication tokens, and site content. A fix for this vulnerability has been released in Ghost version 6.19.1.

Description: Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
Source: security-advisories@github.com
NVD status: Modified
Products: ghost

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "1DD2D680-6968-4F14-A055-9F81B8043085",
            "versionEndExcluding": "6.19.1",
            "versionStartIncluding": "3.24.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.