Vulnerability in Ghost CMS 2FA Mechanism Affects Multiple Versions
CVE-2026-22594
8.1HIGH
What is CVE-2026-22594?
A vulnerability in the two-factor authentication (2FA) mechanism of Ghost, a popular Node.js content management system, allows authorized staff users to bypass email verification. This issue arises from a flaw in the implementation of the 2FA process, which can have serious security implications for account integrity. It is essential for users operating versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3 to upgrade to versions 5.130.6 or 6.11.0 to mitigate this risk.
Affected Version(s)
Ghost >= 6.0.0, < 6.11.0 < 6.0.0, 6.11.0
Ghost >= 5.105.0, < 5.130.6 < 5.105.0, 5.130.6