Ghost CMS CVE-2026-103285

Exploitation requires the targeted victim to be an authenticated Ghost member with an active logged-in session, and that victim must visit an attacker-crafted link/page (UI:P passive interaction) that auto-submits to the post feedback endpoint. The flaw exists because the feedback functionality lacks CSRF protection (no anti-CSRF token / origin validation). The attacker needs no account or privileges on the target site (PR:N), but cannot act without a logged-in member clicking through. Limiting factors: impact is confined to forging post feedback (integrity-only, no confidentiality or availability effect), and sites on 6.57.1 or later are not affected.

This is a genuine but low-severity issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, 5.3 Medium) is internally consistent with a classic CSRF: network-reachable, no attacker privileges, but requiring passive victim interaction (clicking a crafted link) and yielding only a low integrity impact with zero confidentiality or availability loss. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so real-world exploitation pressure is minimal. The impact ceiling is intrinsically narrow - forging post feedback on behalf of a logged-in member is a data-integrity nuisance, not account takeover or data disclosure - so even trivial exploitability does not elevate this to a priority. Treat as a routine patch-in-next-cycle item rather than an emergency; the 5.3 score accurately reflects low business risk.

An attacker crafts a malicious web page or link containing an auto-submitting request to a Ghost site's post feedback endpoint and lures an authenticated member to visit it (e.g., via email or a forum post). When the logged-in member's browser loads the page, their session cookie is sent automatically and feedback is submitted in their name without their knowledge. No public exploit code is known, but CSRF of this kind is straightforward to weaponize with a hidden auto-submitting form.