PT-2026-2216 · Ghost · Ghost

Odgrso · Publicado 2026-01-08 · Atualizado 2026-01-15 · CVE-2026-22594

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions 5.105.0 through 5.130.5 Ghost versions 6.0.0 through 6.10.3

Description Ghost is a Node.js content management system. A flaw in Ghost’s 2FA mechanism permits staff users to bypass email 2FA. The issue affects the two-factor authentication process for staff users.

Recommendations Ghost version 5.105.0 through 5.130.5 should be updated to version 5.130.6. Ghost version 6.0.0 through 6.10.3 should be updated to version 6.11.0.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BIT-GHOST-2026-22594

CVE-2026-22594

GHSA-5FP7-G646-CCF4

Produtos afetados

Ghost

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22594.json · Exploit
• https://github.com/TryGhost/Ghost · Nota
• https://github.com/TryGhost/Ghost/commit/b59f707f670e6f175b669977724ccf16c718430b · Correção
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-5fp7-g646-ccf4 · Aviso do Fabricante
• https://github.com/TryGhost/Ghost/commit/fc7bc2fb0888513498154ec5cb4b21eccb88de07 · Correção
• https://twitter.com/cracbot/status/2011755306657989027 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2009828055234040029 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2009907676889653634 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22594 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009837428345823620 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22594 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2010357384150188269 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-5fp7-g646-ccf4 · Aviso do Fabricante