Executive brief
Ghost is a popular open-source content management platform used for publishing, memberships, and newsletters. A vulnerability in its two-factor authentication (2FA) system allows staff users to bypass email verification during login by manipulating API requests. This could enable attackers with compromised staff credentials to gain unauthorized access to sensitive publishing and subscription management features without completing the required second authentication factor.
Technical details
The vulnerability is an improper authentication implementation (CWE-287) in Ghost's session creation endpoint. The endpoint accepted a skipEmailVerification property intended only for UX convenience after password resets (which are email-verified). However, staff users or attackers with valid credentials could manually add this property to any session creation API request to bypass 2FA entirely. The attack requires valid staff username and password credentials but no user interaction beyond crafting the API request. The fix (versions 5.130.6 and 6.11.0) removes the blanket skipEmailVerification property and replaces it with a secure OTP-based flow: password reset endpoints now generate an emailVerificationToken (OTP), and the session endpoint accepts this token to verify identity without requiring an additional email step.
Affected products
- Ghost Ghost 5.105.0 to 5.130.5, 6.0.0 to 6.10.3
Timeline
- 2026-01-08: disclosed: GHSA-5fp7-g646-ccf4 advisory published
- 2026-01-08: patched: Fix merged; Ghost 5.130.6 and 6.11.0 released