Ghost, a Node.js content management system, suffers from a flaw in its two‑factor authentication mechanism that lets staff users bypass the required email verification. This is an improper authentication vulnerability (CWE‑287) that could allow an attacker to gain staff‑level access without a second factor, compromising the confidentiality, integrity, and availability of the system.

The vulnerability affects TryGhost’s Ghost CMS. Affected releases include versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3. Patching to 5.130.6 or higher, or 6.11.0 or higher, removes the flaw.

The CVSS score is 8.1, indicating a high severity flaw. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote via the web interface, where an attacker possessing a staff account or credentials can skip the 2FA step to gain elevated privileges. Because no additional exploit conditions are noted, the risk is primarily moderated by the need for pre‑existing staff credentials or the ability to compromise them first.