Ghost has incomplete CSRF protections around OTC use

CAO 8.8CVE-2026-29784 · BIT-ghost-2026-29784 · GHSA-9m84-wc28-w895 · Công bố 07/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-29784 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng ghost (ghost), ghost.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.17%, cao hơn 6.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.19.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
ghost ghost	`≥ 5.101.6, < 6.19.3`	`6.19.3`
ghost npm	`≥ 5.101.6, < 6.19.3`	`6.19.3`

Mô tả

Impact

Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.

Vulnerable versions

This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.

Patches

v6.19.3 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.

For more information

If there are any questions or comments about this advisory, send an email to [email protected].

Mô tả của NVD

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.