CVE-2026-29784: Ghost has incomplete CSRF protections around OTC use

March 5, 2026 (updated March 9, 2026)

Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.

References

github.com/TryGhost/Ghost
github.com/TryGhost/Ghost/commit/ec065a774fa125953d2aa644a59cd8990329e0a0
github.com/TryGhost/Ghost/security/advisories/GHSA-9m84-wc28-w895
github.com/advisories/GHSA-9m84-wc28-w895
nvd.nist.gov/vuln/detail/CVE-2026-29784

Code Behaviors & Features

Detect and mitigate CVE-2026-29784 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →