CVE-2026-103283 — Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypa…
Published: 2026-10-01 · CVSS: 8.6 · CVSS 4.0
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to impersonate other staff members and gain unauthorized access to administrative functions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7