CVE-2026-29784
EUVD-2026-1016307.03.2026, 16:15
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ghost | ghost | 5.101.6 ≤ 𝑥 < 6.19.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration