What is GHSA-9m84-wc28-w895?

GHSA-9m84-wc28-w895 is a security advisory published by GitHub Security Advisories with High severity. Ghost has incomplete CSRF protections around OTC use

Which CVE IDs does GHSA-9m84-wc28-w895 cover?

GHSA-9m84-wc28-w895 covers the following CVE IDs: CVE-2026-29784. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9m84-wc28-w895?

GHSA-9m84-wc28-w895 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-9m84-wc28-w895?

GHSA-9m84-wc28-w895 affects 1 product, including: npm/ghost:\u003e= 5.101.6, \u003c= 6.19.2.

GHSA-9m84-wc28-w895HighCVSS 7.5

Ghost has incomplete CSRF protections around OTC use

Vendor

GitHub Security Advisories

Published

March 5, 2026

Last Modified

March 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-29784 →

📋 Description

Impact

Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.

Vulnerable versions

This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.

Patches

v6.19.3 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.

For more information

If there are any questions or comments about this advisory, send an email to [email protected].

🎯 Affected products1

npm/ghost:>= 5.101.6, <= 6.19.2