Description
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to impersonate other staff members and gain unauthorized access to administrative functions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TryGhost | Ghost | 6.20.0 – < 6.57.1 | 6.57.1 |
References
- GitHub Security Advisory (GHSA-q55r-w7fh-rmh6) vendor-advisory
- VulnCheck Advisory: Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling third-party-advisory