Ghost has incomplete CSRF protections around OTC use

高 8.8CVE-2026-29784 · BIT-ghost-2026-29784 · GHSA-9m84-wc28-w895 · 07/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-29784 は ghost (ghost), ghost に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.17%（全脆弱性の 6.0% より高い）。
対処：6.19.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ghost ghost	`≥ 5.101.6, < 6.19.3`	`6.19.3`
ghost npm	`≥ 5.101.6, < 6.19.3`	`6.19.3`

概要

Impact

Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.

Vulnerable versions

This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.

Patches

v6.19.3 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.

For more information

If there are any questions or comments about this advisory, send an email to [email protected].

NVD の説明

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.