CVE-2026-22594

Ghost has Staff 2FA bypass

8.1 HighPublic exploitFix available

Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.31%Up 1.3 points since Jan 10, 2026

What each source reports

CVE List Score used 8.1

Ghost has Staff 2FA bypass

Record: CVE-2026-22594
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2026-1459 8.1

Record: EUVD-2026-1459
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5fp7-g646-ccf4 8.1

Ghost has Staff 2FA bypass

Impact

A vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA.

Vulnerable versions

This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.

Patches

v5.130.6 and v6.11.0 contain a fix for this issue.

References

Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.

For more information

If there are any questions or comments about this advisory, email Ghost at [email protected].

Record: GHSA-5fp7-g646-ccf4
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

NVD 8.1

Record: CVE-2026-22594
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV 8.1

Ghost has Staff 2FA bypass

Record: CVE-2026-22594
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVGHSA-5fp7-g646-ccf4 8.1

Ghost has Staff 2FA bypass

Impact

A vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA.

Vulnerable versions

This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.

Patches

v5.130.6 and v6.11.0 contain a fix for this issue.

References

Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.

For more information

If there are any questions or comments about this advisory, email Ghost at [email protected].

Record: GHSA-5fp7-g646-ccf4
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVBIT-ghost-2026-22594 No score

Ghost has Staff 2FA bypass

Record: BIT-ghost-2026-22594
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ghost` npm	6.0.0 to 6.10.3	6.11.0
`ghost` npm	5.105.0 to 5.130.5	5.130.6
`ghost` Bitnami	5.105.0 up to 5.130.6, 6.0.0 up to 6.11.0	5.130.66.11.0
`ghost` npm	6.0.0 up to 6.11.0	6.11.0
`ghost` npm	5.105.0 up to 5.130.6	5.130.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Ghost CMS Remote Code Execution	2026-03-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-22594 is a high vulnerability (CVSS 8.1) in Ghost, published January 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in ghost 6.11.0.