CVE-2026-103285 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The identified vulnerability resides within Ghost versions ranging from 5.19.0 up to, but not including, version 6.57.1, specifically affecting the post feedback functionality of the platform. This security flaw is classified as a Cross-Site Request Forgery, commonly referred to by its acronym CSRF. In this context, the vulnerability exploits the trust that an authenticated web application places in the user's browser session. When a logged-in member visits a maliciously crafted link or page controlled by an attacker, the browser automatically includes valid authentication credentials, such as cookies or session tokens, with any requests made to the Ghost server. Because the feedback submission endpoint does not adequately verify the origin of the request or require additional proof that the action was intentionally initiated by the user, the application processes the forged request as if it were legitimate and authorized by the authenticated individual.
From a technical perspective, this flaw stems from insufficient validation mechanisms on the server side for state-changing operations involving post feedback. The absence of anti-CSRF tokens or strict SameSite cookie attributes allows an attacker to construct a URL that triggers the submission process without any user interaction beyond simply loading the page in their browser. This mechanism bypasses standard security controls designed to prevent unauthorized actions, enabling the injection of arbitrary feedback data into existing posts. The attack vector is particularly insidious because it relies on social engineering or lure tactics where victims are tricked into visiting a malicious site while already authenticated with Ghost, thereby leveraging their active session against them without any explicit consent or awareness.
The operational impact of this vulnerability allows attackers to manipulate the content associated with blog posts by submitting false feedback under the guise of legitimate users. This can lead to data integrity issues within the platform, as comments and ratings may no longer accurately reflect genuine user sentiment. Furthermore, if the feedback system is integrated into broader community features or moderation workflows, malicious actors could potentially disrupt these processes, spam content, or attempt further exploitation by embedding harmful links in the submitted feedback. For organizations using Ghost for critical communications or customer engagement, this represents a significant risk to reputation and trust, as users may perceive their interactions with the platform as compromised if they discover unauthorized activity associated with their accounts.
To mitigate this vulnerability, administrators must upgrade immediately to version 6.57.1 or any later release where the issue has been patched by implementing robust CSRF protection mechanisms. These measures typically include generating unique, unpredictable anti-CSRF tokens that are validated on every state-changing request and ensuring that cookies used for authentication have appropriate SameSite attributes set to Strict or Lax. Additionally, developers should implement custom header validation checks to ensure requests originate from the expected domain. For users unable to upgrade immediately due to compatibility constraints, applying a Web Application Firewall rule that blocks suspicious POST requests lacking valid tokens can provide temporary relief until the patch is applied. Regular security audits and adherence to OWASP guidelines for session management are recommended to prevent similar issues in future development cycles.