# ghost CVE-2026-26980 Hack

**URL:** <https://forum.ghost.org/t/ghost-cve-2026-26980-hack/62961>\
**Category:** Developer help\
**Created:** [May 27, 2026, 11:42pm UTC](https://forum.ghost.org/t/ghost-cve-2026-26980-hack/62961 "2026-05-27T23:42:12Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\
**Post date:** [May 28, 2026, 1:17am UTC](https://forum.ghost.org/t/ghost-cve-2026-26980-hack/62961/2 "2026-05-28T01:17:15Z")

</div>

Maybe start here and the thread linked from it?

> [@If you are on Ghost \< 6.19.1, you REALLY need to update](https://forum.ghost.org/t/if-you-are-on-ghost-6-19-1-you-really-need-to-update/62706/9):
>
> I’m just replying to this thread to bump it, as I just had Mailgun yesterday disable ALL my sending privileges and deactivate my account due to an exploitation of this bug. I’m good at keeping my production sites up to date, but a lingering staging site for a client was still hanging around on an old version. The key from that install was used to create rogue SMTP sending accounts on Mailgun, on a different domain on my account (as Ghost uses an admin API key). Mailgun were very helpful in res…

---

_[View the full topic](https://forum.ghost.org/t/ghost-cve-2026-26980-hack/62961)._