CVE-2026-29784

HIGH

Ghost 5.101.6-6.19.2 - Cross-Site Request Forgery via Session Verification

Title source: llm
STIX 2.1

Description

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0016
EPSS Percentile 5.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-352
Status published
Products (2)
ghost/ghost 5.101.6 - 6.19.3
npm/ghost 5.101.6 - 6.19.3npm
Published Mar 07, 2026
Tracked Since Mar 07, 2026