CVE-2026-26980
Ghost is a Node.js content management system.
Published Feb 20, 2026 · updated Jun 17, 2026 · ghost ghost
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 20, 2026 · NIST NVD
Detected
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
Jun 17, 2026 · NIST NVD
Updated
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
Affected
- cpe ghost/ghostversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-26980
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-26980
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
nvd.nist.gov