CVE-2026-22594 | THREATINT

Description

Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

PUBLISHED Reserved 2026-01-07 | Published 2026-01-10 | Updated 2026-01-12 | Assigner GitHub_M

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-287: Improper Authentication

Product status

>= 6.0.0, < 6.11.0

affected

>= 5.105.0, < 5.130.6

affected

References

github.com/.../Ghost/security/advisories/GHSA-5fp7-g646-ccf4

github.com/...ommit/b59f707f670e6f175b669977724ccf16c718430b

github.com/...ommit/fc7bc2fb0888513498154ec5cb4b21eccb88de07

cve.org (CVE-2026-22594)

nvd.nist.gov (CVE-2026-22594)

Download JSON