Ghost, a Node.js content management system, contains a SQL injection flaw in the /ghost/api/admin/members/events endpoint. The flaw enables users who possess valid Admin API credentials to inject and execute arbitrary SQL statements. Attackers could use this capability to read, modify, or delete database records, potentially extracting sensitive user information or escalating privileges within the system.

The affected products are Ghost versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3. These include all releases of Ghost v5.x and v6.x up to the listed boundaries. Patches were released in Ghost 5.130.6 and 6.11.0, eliminating the vulnerability. Systems running any of the vulnerable versions and exposing the Admin API should therefore be updated promptly.

The CVSS base score of 6.7 indicates moderate severity, and the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to authenticate against the Admin API; therefore, exposure is limited to actors who can obtain API credentials or have privileged access. While the risk is mitigated by low exploitation likelihood, any compromised or leaked credentials could allow an attacker to seize control of the database.