Advisory · CVE-2026-103283
Ghost staff could become any colleague with just a password, 2FA ignored
A Ghost session-handling bug let any authenticated staff user log in as any other staff user with only the password, bypassing two-factor authentication entirely.
- Vendor
- Ghost
- Product
- Ghost
- Identifier / CWE
- CVE-2026-103283
CWE-613 - Action timing
- Immediate
Explain it like I’m five
The office had a strict two-lock door, but the receptionist's sign-in sheet let any employee write down a coworker's name and walk in. The second lock never got checked.
- 01Staff credentials held
An attacker holds valid credentials for any Ghost staff account, a low bar in a shared or compromised environment.
- 02Switch-user attempted
The attacker exploits improper session management to initiate a login as a different staff user.
- 03Password accepted alone
The target account's password is enough; the two-factor authentication step is bypassed.
- 04Colleague impersonated
The attacker gains the victim staff user's session and administrative functions.
What happened
Ghost’s security advisory GHSA-q55r-w7fh-rmh6 describes a session-handling vulnerability (CWE-613) affecting Ghost versions 6.20.0 up to 6.57.1, fixed in 6.57.1. The flaw allowed any authenticated staff user to log in as any other staff user with only the password, bypassing two-factor authentication.
Improper session management meant the 2FA gate simply did not apply on this path. Any staff account, including a low-privilege one, became a stepping stone to full administrative impersonation of any colleague, including owners.
What to do
- Upgrade to Ghost 6.57.1 or later.
- Rotate passwords for all staff accounts, and re-enroll 2FA where your policy requires it.
- Audit staff session and login logs for logins inconsistent with the account owner’s normal patterns.
- Review who holds staff accounts and remove any that are no longer needed.
Management note
Two-factor authentication that can be skipped by asking differently is not two-factor authentication. If your Ghost instance has multiple staff users, treat every staff account as potentially impersonated until the logs say otherwise.