CVE-2026-29784: Ghost CMS CSRF Vulnerability

CVE-2026-29784 Overview

Ghost is a popular Node.js content management system used for professional publishing. A significant Cross-Site Request Forgery (CSRF) vulnerability has been identified in Ghost CMS versions 5.101.6 through 6.19.2. The vulnerability stems from incomplete CSRF protections around the /session/verify endpoint, which allows One-Time Codes (OTCs) to be used in login sessions different from the originating session. This flaw could be leveraged by attackers to facilitate phishing campaigns targeting Ghost site administrators, potentially leading to complete site takeover.

Critical Impact
This CSRF vulnerability enables attackers to potentially hijack administrative sessions on Ghost CMS installations, allowing unauthorized access to publishing controls, user data, and site configuration.

Affected Products

Ghost CMS versions 5.101.6 through 6.19.2
Ghost for Node.js deployments within the affected version range

Discovery Timeline

2026-03-07 - CVE-2026-29784 published to NVD
2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29784

Vulnerability Analysis

This vulnerability falls under CWE-352 (Cross-Site Request Forgery), a classic web application security flaw where insufficient validation of request origins allows attackers to forge authenticated requests on behalf of legitimate users. The issue specifically affects Ghost's session verification mechanism, where One-Time Codes (OTCs) were not properly bound to the originating session context.

The authentication flow in vulnerable versions failed to validate that OTCs were being submitted from the same session that requested them. This session binding deficiency meant that an attacker who could trick an administrator into clicking a malicious link could potentially capture or replay OTCs across different sessions, effectively bypassing the intended authentication protections.

Root Cause

The root cause lies in the session verification endpoint's (/session/verify) failure to properly associate and validate OTCs with their originating session context. The authentication endpoint did not enforce strict session binding during the password reset and session assignment flow, allowing cross-session OTC usage.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker would need to craft a malicious page or link that exploits the CSRF weakness. When a Ghost administrator visits the attacker-controlled content while authenticated, the incomplete CSRF protections could allow the attacker to manipulate the session verification process. This could potentially be combined with phishing techniques to capture OTCs or redirect session establishment to attacker-controlled sessions.

The security patch addresses this by implementing proper session validation during the password reset flow:

javascript

            const internalOptions = Object.assign(options, {context: {internal: true}});
 
            const doResetParams = await auth.passwordreset.doReset(internalOptions, tokenParts, api.settings);

            if (!frame.original.session) {
                throw new errors.InternalServerError({
                    message: 'Could not initialize an admin session during password reset.'
                });
            }

            const origin = auth.session.getOriginOfRequest(frame.original);
            await auth.session.sessionService.assignVerifiedUserToSession({
                session: frame.original.session,
                user: doResetParams.user,
                origin,
                ip: frame.options.ip
            });

            web.shared.middleware.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
            return {};
        }
    },

Source: GitHub Commit ec065a77

The fix ensures that sessions are properly validated before assignment and that the session binding occurs with origin verification and IP tracking, preventing cross-session OTC misuse.

Detection Methods for CVE-2026-29784

Indicators of Compromise

Unusual authentication attempts to /session/verify endpoint from unexpected IP addresses or geographic locations
Multiple OTC validation requests originating from different sessions within a short timeframe
Failed session initialization errors in Ghost admin logs
Suspicious referrer headers on authentication endpoints indicating external origin

Detection Strategies

Monitor Ghost application logs for abnormal patterns in session verification requests
Implement web application firewall (WAF) rules to detect CSRF attack patterns targeting Ghost authentication endpoints
Review access logs for unexpected requests to /session/verify with mismatched session identifiers
Deploy SentinelOne Singularity to detect anomalous Node.js process behavior and suspicious network activity

Monitoring Recommendations

Enable verbose logging for Ghost authentication events and review periodically
Set up alerting for failed session assignment errors with the message "Could not initialize an admin session during password reset"
Monitor for unusual administrator account activity following any authentication anomalies
Implement network traffic analysis to identify potential CSRF payload delivery attempts

How to Mitigate CVE-2026-29784

Immediate Actions Required

Upgrade Ghost CMS to version 6.19.3 or later immediately
Audit administrator accounts for any unauthorized access or unexpected session activity
Review Ghost admin access logs for the period while running vulnerable versions
Temporarily restrict admin panel access to trusted IP addresses if immediate patching is not possible

Patch Information

Ghost has released version 6.19.3 which addresses this vulnerability. The patch implements proper session validation during password reset flows, ensuring that sessions are properly initialized and verified before user assignment. The fix binds OTCs to their originating sessions and validates the request origin and IP address during session establishment.

For detailed patch information, refer to the GitHub Security Advisory GHSA-9m84-wc28-w895 and the security commit.

Workarounds

Implement additional CSRF protections at the reverse proxy or WAF level for Ghost authentication endpoints
Enable IP-based access restrictions for the Ghost admin panel
Deploy multi-factor authentication mechanisms external to Ghost for administrator access
Consider placing Ghost admin behind a VPN or zero-trust network access solution until patching is complete

bash

# Configuration example
# Restrict Ghost admin panel access via nginx reverse proxy
location /ghost {
    # Allow only trusted IP ranges
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
    
    # Additional CSRF protection headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    proxy_pass http://localhost:2368;
}