CVE-2026-29784: Ghost: Incomplete CSRF protections around OTC use
Impact
Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.
Vulnerable versions
This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.
Patches
v6.19.3 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.
For more information
If there are any questions or comments about this advisory, send an email to security@ghost.org.
Other sources
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29784?
CVE-2026-29784 is classified as a medium severity vulnerability due to its potential for facilitating unauthorized access to Ghost sites.
How do I fix CVE-2026-29784?
To fix CVE-2026-29784, upgrade your Ghost installation to version 6.19.3 or later.
What is the impact of CVE-2026-29784?
The impact of CVE-2026-29784 allows attackers to exploit incomplete CSRF protections to potentially hijack login sessions.
Which versions of Ghost are affected by CVE-2026-29784?
CVE-2026-29784 affects Ghost versions between 5.101.6 and 6.19.2, inclusive.
What are OTCs in the context of CVE-2026-29784?
OTCs refer to One-Time Cookies that are meant to secure login sessions, which are inadequately protected in this vulnerability.