VYPR
← All advisories
High severity8.1OSV Advisory· Published Jan 10, 2026· Updated Jun 17, 2026

CVE-2026-22594

CVE-2026-22594

Description

Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ghostnpm
>= 6.0.0, < 6.11.06.11.0
ghostnpm
>= 5.105.0, < 5.130.65.130.6

Affected products

4
  • Tryghost/GhostOSV2 versions
    v5.105.0, v5.106.0, v5.106.1, …+ 1 more
    • (no CPE)range: v5.105.0, v5.106.0, v5.106.1, …
    • cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*range: >=5.105.0,<5.130.6
  • osv-coords2 versions
    pkg:bitnami/ghostpkg:npm/ghost
    >= 5.105.0, < 5.130.6+ 1 more
    • (no CPE)range: >= 5.105.0, < 5.130.6
    • (no CPE)range: >= 6.0.0, < 6.11.0

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.