GHSA-5fp7-g646-ccf4: Ghost has Staff 2FA bypass

Skip to content

Navigation Menu

• • AI CODE CREATION

    • GitHub CopilotWrite better code with AI

    • GitHub SparkBuild and deploy intelligent apps

    • GitHub ModelsManage and compare prompts

    • MCP RegistryNewIntegrate external tools

View all features

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2026-22594

Ghost has Staff 2FA bypass

High severity GitHub Reviewed Published Jan 8, 2026 in TryGhost/Ghost • Updated Jan 8, 2026

Affected versions

>= 6.0.0, <= 6.10.3

>= 5.105.0, <= 5.130.5

Patched versions

6.11.0

5.130.6

Description

Impact

A vulnerability in Ghost’s 2FA mechanism allows staff users to skip email 2FA.

Vulnerable versions

This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.

Patches

v5.130.6 and v6.11.0 contain a fix for this issue.

References

Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.

For more information

If there are any questions or comments about this advisory, email Ghost at security@ghost.org.

References

• GHSA-5fp7-g646-ccf4
• TryGhost/Ghost@b59f707
• TryGhost/Ghost@fc7bc2f

Published to the GitHub Advisory Database

Jan 8, 2026

EPSS score