CVE-2026-26980: Ghost CMS unauthenticated SQL injection reads the database
The short version: Ghost — the Node.js publishing platform — has a SQL injection flaw (CVE-2026-26980) that lets an unauthenticated attacker perform arbitrary reads from the site's database. It's fixed in Ghost 6.19.1. If you self-host an affected version on the internet, upgrade. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated data exposure |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (vendor / GitHub CNA) | 9.4 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| EPSS | ~70.00% · 99th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in the wild; public technical analysis exists |
| Vulnerability type | CWE-89 SQL injection → unauthenticated arbitrary database read |
| Requires authenticated session? | No — pre-authentication |
| Affected | Ghost 3.24.0 through 6.19.0 |
| Fixed in | 6.19.1 |
What you need to know
Ghost accepts input that reaches a database query without sufficient sanitization, so an unauthenticated attacker can inject SQL and read data the application never meant to expose. In practice that means the contents of the CMS database — user records, hashed credentials, session material, and any private content stored there — can be enumerated by anyone who can reach the site.
Why it's worth prioritizing:
- It's pre-authentication. No account, no chain — just a reachable Ghost instance running an affected version.
- The vulnerable range is wide. Everything from 3.24.0 through 6.19.0 is affected, so long-lived, rarely-updated blogs are squarely in scope.
How serious we see it
High.
The NVD scores it 7.5 (confidentiality only — an information read), while Ghost's own advisory rates it 9.4 to reflect the broader impact. We call it High: an unauthenticated, network-reachable read of the backing database is a serious data-exposure issue, even though it isn't code execution. The reassuring part is that it's bounded and fixable — a single upgrade to 6.19.1 closes it, and you can tell quickly whether you're affected.
Recommendations
Straight from Ghost's advisory:
- Patch now. Upgrade to Ghost 6.19.1 or later.
- Assume data may have been read; rotate secrets. If you ran an exposed, affected version, rotate credentials and session secrets and prompt password resets where warranted.
- Restrict exposure until you patch. Limit access to trusted networks where feasible.
- Confirm your exposure first. Verify whether you self-host Ghost and which version you run (Ghost(Pro)-managed sites are updated by the vendor).
How BreachRisk sees it
BreachRisk discovers internet-facing Ghost sites in your external footprint, fingerprints the version from the application's responses, and flags exposure tied to this CVE. We detect and flag the affected version — we don't attempt SQL injection against your live database, because a safe test isn't worth the risk to your data.
That outside-in, continuous view means a forgotten Ghost blog on a marketing subdomain is already mapped and version-checked, so a flaw like this surfaces as a specific, actionable finding rather than a surprise.