UpHeron
All vulnerabilities

Servers and applications

GHSA-fxxr-gqx3-p253

Brute-Force Protection Bypass via Concurrent Requests and Missing Rate Limits

Severity
High 8.1
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
6.76.0
Weakness
No limit on authentication attempts (CWE-307)Race condition (CWE-362)CWE-799
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

Ghost's brute-force protection could be partially bypassed, allowing an unauthenticated attacker to make many more staff sign-in and staff verification (2FA) code attempts than the configured limits allow. This also affected other rate-limited endpoints, including member sign-in emails and private site access.

This release also fixes related gaps in staff sign-in rate limiting: someone holding valid staff credentials could repeatedly trigger verification emails to that staff user, and verification code attempts were not limited across IP addresses or sessions.

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

From TryGhost/Ghost's security advisory.

Affected software

SoftwareAffected versions
GhostServers and applications · github:tryghost/ghost
  • From 1.0.0-alpha.8 before 6.76.0

References