Ghost CMS Vulnerabilities: Privilege Escalation and 2FA Bypass

github.com

Ghost CMS Vulnerabilities: Privilege Escalation and 2FA Bypass

First seen 4 Oct 2026, 05:06 UTC • •57.8

Article Content

1 / 3

Browse articles

ThreatCluster •October 4, 2026 at 08:03 UTC

•Two critical vulnerabilities in Ghost CMS allow privilege escalation and 2FA bypass.
•Affected versions range from v4.39.0 to v6.64.0 and v6.20.0 to v6.57.1 respectively.
•Patches are available in the latest releases; users are urged to update immediately.

Two vulnerabilities affecting Ghost CMS have been disclosed. The first, identified as GHSA-v6q3-xqxm-6f5v, allows staff users to discover secret tokens for pending invites, enabling privilege escalation. This affects versions from v4.39.0 to v6.64.0, with a fix in v6.64.0. The second vulnerability, GHSA-q55r-w7fh-rmh6, permits any authenticated staff user to log in as another staff user by bypassing two-factor authentication, impacting versions from v6.20.0 to v6.57.1, with a patch in v6.57.1. Both vulnerabilities were disclosed responsibly by researchers and are for self-hosted instances of Ghost CMS. Users are advised to update their installations promptly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-02

GHSA-q55r-w7fh-rmh6 disclosed

A session handling bug was reported allowing staff users to bypass 2FA and log in as others.

2026-10-03

GHSA-v6q3-xqxm-6f5v disclosed

A privilege escalation vulnerability was disclosed, allowing staff users to accept pending invites for higher roles.

More articles in this cluster (2)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-287 - Improper Authentication

Technique (1)

T1068 - Exploitation for Privilege Escalation

Threat Actor (1)

Ghost

Tool (1)

Docker

Relationships

Ghost uses Docker
Ghost uses T1068 - Exploitation for Privilege Escalation
Ghost related to CWE-200 - Exposure of Sensitive Information
Ghost related to CWE-287 - Improper Authentication

Following this threat?

Track Ghost in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What versions of Ghost are affected?

Versions from v4.39.0 to v6.64.0 for the privilege escalation issue, and v6.20.0 to v6.57.1 for the 2FA bypass.

Have these vulnerabilities been exploited in the wild?

No confirmed exploitation has been reported; both vulnerabilities have been disclosed and patched.

What should I do to protect my Ghost installation?

Update to the latest versions (v6.64.0 and v6.57.1) to mitigate these vulnerabilities.

Continue Reading

Ghost CMS Vulnerabilities: Authentication Bypass and Account Modification Risks Two vulnerabilities have been identified in the Ghost CMS platform affecting versions 5.2.0 to 6.62.0 and 6.20.0 to 6.57.1. The first vulnerability allows unauthenticated account modification during Stripe checkout, while the second enables authentication bypass via session handling. These flaws could potentially…

Citrix NetScaler Critical Vulnerabilities Exploited: Urgent Patching Required Citrix NetScaler ADC and Gateway products are affected by critical vulnerabilities CVE-2026-88771 and CVE-2026-88772, both assigned a CVSS score of 9.5. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on September 27, 2026, and mandated…