CVE-2026-103279 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Ghost CMS versions ranging from 3.10.0 up to, but not including, version 6.34.0 represents a critical authentication control failure that undermines the fundamental security assumption of session invalidation upon credential rotation. This flaw is categorized under CWE-279, which denotes Incorrect Execution Assignment or specifically in this context, improper handling of state changes during authentication lifecycle events. When an administrator or user initiates a password change within the Ghost application interface, the system is designed to terminate all existing active sessions for that account to prevent unauthorized persistence. However, due to a logic error in the session management module, only specific primary sessions are invalidated while secondary or background sessions remain valid and operational. This incomplete invalidation creates a persistent backdoor mechanism that allows previously authenticated entities to retain access despite the credential update intended to revoke it.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically regarding persistence through session hijacking or reuse. An attacker who has successfully obtained a valid session cookie through methods such as cross-site scripting (XSS), network sniffing on unencrypted connections, or physical access to an unlocked workstation can exploit this flaw to maintain long-term access. Even if the victim user detects suspicious activity and promptly changes their password—a standard incident response procedure—the attacker’s stolen session token remains functional within the application context. This effectively neutralizes one of the most effective defensive measures against account compromise, forcing organizations to rely on additional controls such as IP-based anomaly detection or mandatory re-authentication for sensitive operations rather than relying solely on credential rotation to mitigate ongoing threats.
The operational impact of this vulnerability is severe, particularly in environments where Ghost CMS is used for managing content with multiple contributors or administrators. It allows attackers to bypass standard incident response protocols and maintain stealthy access over extended periods. This persistence can lead to unauthorized modification of site settings, exfiltration of sensitive data stored within the platform, defacement of public-facing pages, or further lateral movement if the compromised account has elevated privileges. The risk is exacerbated in shared hosting environments or multi-tenant deployments where session isolation might be less rigorous, potentially allowing an attacker to pivot between accounts or escalate privileges by leveraging stale sessions associated with higher-level roles.
To mitigate this vulnerability, organizations running Ghost CMS must upgrade immediately to version 6.34.0 or any later release that includes the corrected session invalidation logic. For systems that cannot be updated instantly due to operational constraints, temporary mitigations should focus on reducing the window of exposure and limiting the impact of stolen sessions. Implementing strict HTTP-only flags on all cookies can prevent client-side script access to session tokens, thereby reducing the risk of theft via XSS attacks. Additionally, enforcing short-lived session timeouts and requiring re-authentication for administrative actions can limit the utility of any stale session cookie that might slip through the invalidation process. Regular auditing of active sessions and monitoring for anomalous login patterns from different geographic locations or user agents can also help detect exploitation attempts early. Ultimately, treating password changes as a hard reset event for all associated tokens is essential to maintaining robust authentication hygiene in web applications.