CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Authenticated staff users can bypass two-factor authentication and impersonate other staff members to gain unauthorized administrative access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103283?
CVE-2026-103283 is a high-severity authentication bypass vulnerability in TryGhost Ghost, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to impersonate other staff members and gain unauthorized access to administrative functions.
Weakness: CWE-613
Which versions are affected by CVE-2026-103283?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 6.20.0 | 6.57.1 |
How do I fix CVE-2026-103283?
Upgrade ghost to 6.57.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-103283 being exploited?
There is no known exploitation of CVE-2026-103283 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103283, GHSA-q55r-w7fh-rmh6, GHSA-xwp3-2mhg-j9rp, MINI-88fw-6f3q-qvcp.