Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staf…

Published:

9 januari 2026 om 23:00:00

Alert date:

10 januari 2026 om 13:10:58

Source:

nvd.nist.gov

CVE-2026-22594 affects Ghost Node.js content management system versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3. The vulnerability allows staff users to bypass email 2FA authentication mechanism. This represents a significant authentication bypass that could allow unauthorized access to administrative functions. The issue has been patched in versions 5.130.6 and 6.11.0. Organizations using affected versions should upgrade immediately to prevent potential unauthorized access.

Technical details

Mitigation steps:

Affected products:

Ghost CMS