CVE-2026-29784
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Mar 7, 2026
CISA due date
—
The record
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | ghost | 5.101.6 | 6.19.3 |
Related vulnerabilities
- GHSA-9m84-wc28-w895 Ghost has incomplete CSRF protections around OTC use Same vulnerability
- CVE-2026-29053 Ghost is a Node.js content management system. Also affects ghost
- GHSA-cgc2-rcrh-qr5x Ghost Vulnerable to Remote Code Execution via Malicious Themes Also affects ghost
- CVE-2026-26980 Ghost is a Node.js content management system. Also affects ghost
- GHSA-w52v-v783-gw97 Ghost has a SQL injection in Content API Also affects ghost
- GHSA-gv6q-2m97-882h Ghost vulnerable to XSS via malicious Portal preview links Also affects ghost
- CVE-2026-24778 Ghost is an open source content management system. Also affects ghost
- CVE-2026-22597 Ghost is a Node.js content management system. Also affects ghost