CVE-2026-103283— Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Quick assessment
Affected
TryGhost Ghost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghost 6.20.0 至 6.57.1（不含）版本存在一个会话处理漏洞，允许已认证的工作人员用户仅凭密码登录为其他任意工作人员账户，从而绕过双因素身份验证（2FA）。拥有有效工作人员凭据的攻击者可利用不当的会话管理机制冒充其他工作人员，进而未经授权访问管理功能。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103283
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Source: CVE Program / CVE List V5
Vulnerability Description
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to impersonate other staff members and gain unauthorized access to administrative functions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103283
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103283
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103283 (2)
Same Patch Batch · TryGhost · 2026-10-01 · 26 CVEs total
| CVE-2026-103268 | 8.8 HIGH | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset |
| CVE-2026-103277 | 8.1 HIGH | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed |
| CVE-2026-103292 | 8.0 HIGH | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head |
| CVE-2026-103271 | 7.5 HIGH | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass |
| CVE-2026-103272 | 7.5 HIGH | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API |
| CVE-2026-103278 | 7.3 HIGH | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe |
| CVE-2026-103286 | 7.3 HIGH | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications |
| CVE-2026-103266 | 7.1 HIGH | Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification |
| CVE-2026-103279 | 6.8 MEDIUM | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass |
| CVE-2026-103289 | 6.5 MEDIUM | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments |
| CVE-2026-103288 | 6.5 MEDIUM | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like |
| CVE-2026-103291 | 6.4 MEDIUM | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch |
| CVE-2026-103281 | 5.4 MEDIUM | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API |
| CVE-2026-103276 | 5.3 MEDIUM | Ghost before 6.20.0 File Read via URL Encoding Bypass |
| CVE-2026-103269 | 5.3 MEDIUM | Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts |
| CVE-2026-103280 | 5.3 MEDIUM | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint |
| CVE-2026-103274 | 5.3 MEDIUM | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read |
| CVE-2026-103285 | 4.3 MEDIUM | Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery |
| CVE-2026-103267 | 4.3 MEDIUM | Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite |
| CVE-2026-103284 | 4.3 MEDIUM | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Ghost
-
CVE-2026-104418
Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Fi -
CVE-2026-104417
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting -
CVE-2026-104416
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin -
CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo R -
CVE-2026-104415
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure
Same vendor: TryGhost
-
CVE-2026-104417
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting -
CVE-2026-104418
Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Fi -
CVE-2026-104416
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin -
CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo R -
CVE-2026-104415
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure
Same weakness: CWE-613
-
CVE-2026-97212
Monta monta.app Insufficient Session Expiration -
CVE-2026-104468
YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via -
CVE-2026-66253
HCL iControl is affected by a Session Timeout vulnerability -
CVE-2026-103279
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass -
CVE-2026-102367
mall4j through 4.0 Insufficient Session Expiration via Token
V. Comments for CVE-2026-103283
No comments yet