BIT-ghost-2026-22594

vendorUSosv

Ghost has Staff 2FA bypass

view advisory published 2026-01-13Licence: per source

Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-22594US	—	1.31% (71st)	Exploit	2026-01-10
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip emai…

references

External citations — patches, advisories, analysis.

https://github.com/TryGhost/Ghost/commit/b59f707f670e6f175b669977724ccf16c718430bFIX
https://github.com/TryGhost/Ghost/commit/fc7bc2fb0888513498154ec5cb4b21eccb88de07FIX
https://github.com/TryGhost/Ghost/security/advisories/GHSA-5fp7-g646-ccf4ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-22594WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan