CVE-2026-22594

highpriority · track · 10EPSS 0.013 · 71 %ileexploit · weaponizedEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · weaponized

Likely / severe?

1.31% (71st) EPSS

CVSS 8.1 · high

Is it mine?

8 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.17.9highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Fsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USCWE-287US

exploits (1)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/ghostcms_auth_rce_cve_2026_29053Ghost CMS Remote Code Executionweaponized · metasploit

affected products (8)

Products and version ranges known to be affected.

TryGhost Ghost5.105.0, → 5.130.6enisa_euvdEU
TryGhost Ghost6.0.0, → 6.11.0enisa_euvdEU
ghost ghost5.105.0 → 5.130.6nvdUScpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:*
ghost ghost6.0.0 → 6.11.0nvdUScpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:*
Bitnami ghost5.105.0 → 5.130.6osvUSpkg:bitnami/ghost
Bitnami ghost6.0.0 → 6.11.0osvUSpkg:bitnami/ghost
npm ghost5.105.0 → 5.130.6osvUSpkg:npm/ghost
npm ghost6.0.0 → 6.11.0osvUSpkg:npm/ghost

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-5fp7-g646-ccf4Ghost has Staff 2FA bypass2026-01-08ghsa · osvUS
### Impact A vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. ### Vulnerable versions This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3. ### Patches v5.130.6 and v6.11.0 contain a fix for this issue. ### References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly. ### For more information If there are any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).
BIT-ghost-2026-22594Ghost has Staff 2FA bypass2026-01-13vendor · osvUS
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2026-01-10modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan