Cross-Site Request Forgery Vulnerability in Ghost Product by Ghost

CVE-2026-103285

What is CVE-2026-103285?

A cross-site request forgery (CSRF) vulnerability has been discovered in Ghost versions from 5.19.0 up to 6.57.1. This security issue allows attackers to exploit the post feedback functionality, enabling them to submit feedback on behalf of authenticated users without their knowledge. By crafting a malicious link to the feedback page, an attacker can manipulate the system to execute actions without user consent, potentially leading to unauthorized posts and compromising user accounts. It is essential for users of the affected versions to apply the necessary patches and updates to safeguard against this vulnerability.

References