Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: TryGhost Ghost 6.57.1 Clear all filters
TI-2026-65660 CVE-2026-103285 · GHSA-264f-w588-vx62

Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery

Priority LOW 23

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00102 Published 2026-10-01 Fixed in 6.57.1 CWE-352
TI-2026-65659 CVE-2026-103284 · GHSA-wm9p-jg8j-w38q

Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

Priority LOW 23

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00168 Published 2026-10-01 Fixed in 6.57.1 CWE-863
TI-2026-65658 CVE-2026-103283 · GHSA-xwp3-2mhg-j9rp

Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Priority LOW 39

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-01 Fixed in 6.57.1 CWE-613