JavaScript Execution Vulnerability in Ghost CMS and Portal
CVE-2026-24778

8.8HIGH

Key Information:

Vendor

Tryghost

Status
Ghost
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24778?

A vulnerability in Ghost, an open-source content management system, allows an attacker to craft a malicious link that executes JavaScript with the permissions of an authenticated user. This exploit may lead to account takeover. Affected versions include Ghost 5.43.0 to 5.12.04 and 6.0.0 to 6.14.0, as well as Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0. To mitigate this risk, users are advised to upgrade to Ghost 5.121.0 or later or Ghost 6.15.0 or later, which load patched Portal versions. Custom installations must be manually updated.

Affected Version(s)

Ghost @tryghost/portal >= 2.29.1, < 2.51.5 < @tryghost/portal 2.29.1, 2.51.5

Ghost @tryghost/portal >= 2.52.0, < 2.57.1 < @tryghost/portal 2.52.0, 2.57.1

Ghost ghost >= 5.43.0, < 5.121.0 < ghost 5.43.0, 5.121.0

References

https://github.com/TryGhost/Ghost/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/TryGhost/Ghost/commit/da858e640e88e69c...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.