CVE-2026-22595: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22595 is a Staff Token permission bypass vulnerability in Ghost, the Node.js content management system. A flaw in Ghost's Admin API middleware allowed external systems authenticated via Staff Tokens (for Admin/Owner-role users) to access certain endpoints that were intended to be restricted to Staff Session authentication only. The vulnerability affects Ghost versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3. It was discovered by Sho Odagiri of GMO Cybersecurity by Ierae, Inc., disclosed on January 8, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Ghost Security Advisory).

The root cause is an incorrect authorization check (CWE-863) in Ghost's Admin API middleware (ghost/core/core/server/web/api/endpoints/admin/middleware.js). The staff token blocklist checked for the paths /db/ and /users/owner/ with trailing slashes only, but Express.js routes accept both /db and /db/ (with and without trailing slash). Requests sent without a trailing slash bypassed the security check entirely, allowing a Staff Token-authenticated external system to issue a DELETE /ghost/api/admin/db request (deleting all content) or a PUT /ghost/api/admin/users/owner request (transferring site ownership) (Ghost Security Advisory, Patch Commit). Exploitation requires the attacker to already possess a valid Staff Token for an Admin or Owner-role user.

Successful exploitation allows an attacker with a valid Admin/Owner-role Staff Token to perform two high-impact actions: deleting all site content via DELETE /ghost/api/admin/db (complete availability loss) or transferring site ownership to an arbitrary user via PUT /ghost/api/admin/users/owner (full integrity compromise and account takeover). While confidentiality impact is rated None (no data exfiltration), the integrity and availability impacts are both rated High, meaning an attacker could irreversibly destroy all published content or seize administrative control of the Ghost instance (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.062% (0.000620), placing it in a low percentile for near-term exploitation probability (GitHub Advisory). Exploitation requires low privileges (a valid Staff Token for an Admin/Owner-role user), no user interaction, and is network-accessible, making it straightforward for any attacker who has obtained such a token.

1. Obtain a Staff Token: Acquire a valid Ghost Staff Token associated with an Admin or Owner-role user. This could be obtained through credential theft, phishing, or compromise of an integrated external system that already holds such a token.
2. Identify the target Ghost instance: Confirm the Ghost installation is running a vulnerable version (5.121.0–5.130.5 or 6.0.0–6.10.3) by checking version disclosure in HTTP headers or the Ghost Admin UI.
3. Craft a request without a trailing slash: Prepare an HTTP request targeting the restricted endpoint without a trailing slash to bypass the blocklist check. For content deletion: DELETE /ghost/api/admin/db. For ownership transfer: PUT /ghost/api/admin/users/owner.
4. Send the request with Staff Token authentication: Include the Staff Token in the Authorization header (e.g., Authorization: Ghost <token>) and send the crafted request to the target Ghost instance.
5. Achieve impact: A successful DELETE /ghost/api/admin/db request wipes all site content; a successful PUT /ghost/api/admin/users/owner with a target user payload transfers site ownership, granting the attacker full administrative control (Ghost Security Advisory, Patch Commit).

• Network: HTTP DELETE requests to /ghost/api/admin/db (without trailing slash) authenticated with a Staff Token; HTTP PUT requests to /ghost/api/admin/users/owner (without trailing slash) authenticated with a Staff Token.
• Logs: Ghost access logs showing DELETE /ghost/api/admin/db or PUT /ghost/api/admin/users/owner (no trailing slash) with a 2xx response code from a Staff Token-authenticated session; unexpected ownership transfer events in Ghost audit logs.
• Application State: Sudden deletion of all posts, pages, and content from the Ghost database; unexpected change of site owner in the Ghost Admin user list to an unrecognized account.
• Authentication Events: Staff Token authentication events originating from unfamiliar IP addresses or external systems not previously associated with Admin/Owner-role tokens (Ghost Security Advisory).

Ghost has released patched versions 5.130.6 (for the 5.x branch) and 6.11.0 (for the 6.x branch) that fix this issue by updating the blocklist check to match both /db and /db/ (and /users/owner and /users/owner/) (Ghost Security Advisory, Patch Commit). Administrators should upgrade immediately. As an interim measure, audit all active Staff Tokens and revoke any tokens associated with external systems that do not require Admin/Owner-level access. Review Ghost access logs for any suspicious DELETE /db or PUT /users/owner requests (without trailing slashes) that may have occurred during the vulnerable window.

The vulnerability was responsibly disclosed by Sho Odagiri of GMO Cybersecurity by Ierae, Inc., and Ghost acknowledged the researcher in their official advisory (Ghost Security Advisory). The advisory was published on January 8, 2026, and received coverage from security aggregators including Vulners, VulDB, and CyberHub Blog shortly after NVD publication on January 10, 2026. Community reaction was limited, consistent with the low EPSS score and absence of public exploit code.