CVE-2026-22594: Ghost CMS 2FA Bypass Vulnerability
Summary
CVE-2026-22594: Ghost has Staff 2FA bypass. Affects ghost across 2 version ranges.
>= 5.105.0, < 5.130.6
>= 6.0.0, < 6.11.0
Fixed in 5.130.6 or 6.11.0, depending on the release line you run. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-22594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source Node.js content management system designed for professional publishing. It provides a user-friendly interface for creating and managing content, along with features such as themes, plugins, and built-in SEO tools. However, certain versions of Ghost have a vulnerability in their two-factor authentication (2FA) mechanism that allows staff users to bypass email verification, potentially compromising account security.
Vulnerability Detail
In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3 of Ghost, a flaw in the 2FA implementation allows staff users to skip the email verification step. This vulnerability can lead to unauthorized access to sensitive areas of the application, as it undermines the security measures intended to protect user accounts. The issue has been identified and patched in subsequent releases, making it critical for users to update their installations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.105.0, < 5.130.65.130.6 -
>= 6.0.0, < 6.11.06.11.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability without upgrading to the patched versions. It is strongly recommended to apply the updates as soon as possible.
Conclusion
The Ghost CMS 2FA bypass vulnerability (CVE-2026-22594) poses a significant risk to user accounts by allowing staff to bypass essential security measures. Users are urged to update to the latest patched versions to ensure their installations are secure.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows staff users to bypass email verification, potentially leading to unauthorized access to sensitive content and administrative functions.
Versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no effective workarounds, it is crucial to prioritize updating your Ghost installation to mitigate the risk.
Detailed information can be found in the vulnerability database at https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-22594.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
