CVE-2026-26980: Ghost CMS unauthenticated SQL injection allows arbitrary database reads

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable SQL injection with high confidentiality impact and very high EPSS, though not in KEV and no confirmed in-the-wild exploitation.

What it is

Ghost versions 3.24.0 through 6.19.0 contain a SQL injection flaw (CWE-89) that lets unauthenticated attackers read arbitrary data from the database. The issue is fixed in 6.19.1. Because Ghost is a public-facing Node.js CMS, exposed instances are directly reachable and the confidentiality impact is high.

Impact

An attacker can read arbitrary database contents without credentials, exposing stored content, user records and other sensitive data held in the Ghost database. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The record does not specify the exact vulnerable endpoint or parameter, so the precise injection point is not stated.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.70208, 99.3rd percentile), indicating elevated likelihood of exploitation. A third-party blog reference on page poisoning exists but carries no tags confirming active exploitation.

What to do

• Upgrade Ghost to version 6.19.1 or later, which contains the fix.
• If immediate upgrade is not possible, apply the mitigations described in the vendor security advisory GHSA-w52v-v783-gw97.
• Restrict network access to the Ghost instance (reverse proxy, IP allowlisting, or WAF rules) until patched.
• Review database and application logs for anomalous query patterns or unexpected read activity.
• Rotate any secrets or credentials that could have been exposed if the database was read.

Detection

• Monitor web server and application logs for SQL injection patterns (UNION, boolean-based, or time-based payloads) in requests to Ghost endpoints.
• Alert on unusual or high-volume database read queries originating from the Ghost application.
• Watch for unexpected outbound or data-exfiltration behavior from the Ghost host.
• Track Ghost version inventory to identify instances still running 3.24.0 through 6.19.0.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.