Vulnerability Details CVE-2026-24778
Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were vulnerable to this issue. Ghost automatically loads the latest patch of the members Portal component via CDN. For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability. v5.121.0 loads Portal v2.51.5, which contains the patch. For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability. v6.15.0 loads Portal v2.57.1, which contains the patch. For Ghost installations using a customized or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 14.0%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-24778
-
cpe:2.3:a:ghost:ghost:5.100.0
-
cpe:2.3:a:ghost:ghost:5.100.1
-
cpe:2.3:a:ghost:ghost:5.101.0
-
cpe:2.3:a:ghost:ghost:5.101.1
-
cpe:2.3:a:ghost:ghost:5.101.2
-
cpe:2.3:a:ghost:ghost:5.101.3
-
cpe:2.3:a:ghost:ghost:5.101.4
-
cpe:2.3:a:ghost:ghost:5.101.5
-
cpe:2.3:a:ghost:ghost:5.101.6
-
cpe:2.3:a:ghost:ghost:5.102.0
-
cpe:2.3:a:ghost:ghost:5.103.0
-
cpe:2.3:a:ghost:ghost:5.104.0
-
cpe:2.3:a:ghost:ghost:5.104.1
-
cpe:2.3:a:ghost:ghost:5.104.2
-
cpe:2.3:a:ghost:ghost:5.105.0
-
cpe:2.3:a:ghost:ghost:5.106.0
-
cpe:2.3:a:ghost:ghost:5.106.1
-
cpe:2.3:a:ghost:ghost:5.106.2
-
cpe:2.3:a:ghost:ghost:5.107.0
-
cpe:2.3:a:ghost:ghost:5.107.1
-
cpe:2.3:a:ghost:ghost:5.107.2
-
cpe:2.3:a:ghost:ghost:5.108.0
-
cpe:2.3:a:ghost:ghost:5.108.1
-
cpe:2.3:a:ghost:ghost:5.108.2
-
cpe:2.3:a:ghost:ghost:5.109.0
-
cpe:2.3:a:ghost:ghost:5.109.1
-
cpe:2.3:a:ghost:ghost:5.109.2
-
cpe:2.3:a:ghost:ghost:5.109.3
-
cpe:2.3:a:ghost:ghost:5.109.4
-
cpe:2.3:a:ghost:ghost:5.109.5
-
cpe:2.3:a:ghost:ghost:5.109.6
-
cpe:2.3:a:ghost:ghost:5.110.0
-
cpe:2.3:a:ghost:ghost:5.110.1
-
cpe:2.3:a:ghost:ghost:5.110.2
-
cpe:2.3:a:ghost:ghost:5.110.3
-
cpe:2.3:a:ghost:ghost:5.110.4
-
cpe:2.3:a:ghost:ghost:5.111.0
-
cpe:2.3:a:ghost:ghost:5.112.0
-
cpe:2.3:a:ghost:ghost:5.113.0
-
cpe:2.3:a:ghost:ghost:5.113.1
-
cpe:2.3:a:ghost:ghost:5.114.0
-
cpe:2.3:a:ghost:ghost:5.114.1
-
cpe:2.3:a:ghost:ghost:5.115.0
-
cpe:2.3:a:ghost:ghost:5.115.1
-
cpe:2.3:a:ghost:ghost:5.116.0
-
cpe:2.3:a:ghost:ghost:5.116.1
-
cpe:2.3:a:ghost:ghost:5.116.2
-
cpe:2.3:a:ghost:ghost:5.117.0
-
cpe:2.3:a:ghost:ghost:5.118.0
-
cpe:2.3:a:ghost:ghost:5.118.1
-
cpe:2.3:a:ghost:ghost:5.119.0
-
cpe:2.3:a:ghost:ghost:5.119.1
-
cpe:2.3:a:ghost:ghost:5.119.2
-
cpe:2.3:a:ghost:ghost:5.119.3
-
cpe:2.3:a:ghost:ghost:5.120.0
-
cpe:2.3:a:ghost:ghost:5.120.1
-
cpe:2.3:a:ghost:ghost:5.120.2
-
cpe:2.3:a:ghost:ghost:5.120.3
-
cpe:2.3:a:ghost:ghost:5.120.4
-
cpe:2.3:a:ghost:ghost:5.43.0
-
cpe:2.3:a:ghost:ghost:5.44.0
-
cpe:2.3:a:ghost:ghost:5.45.0
-
cpe:2.3:a:ghost:ghost:5.45.1
-
cpe:2.3:a:ghost:ghost:5.46.0
-
cpe:2.3:a:ghost:ghost:5.46.1
-
cpe:2.3:a:ghost:ghost:5.76.0
-
cpe:2.3:a:ghost:ghost:5.76.1
-
cpe:2.3:a:ghost:ghost:5.76.2
-
cpe:2.3:a:ghost:ghost:5.77.0
-
cpe:2.3:a:ghost:ghost:5.78.0
-
cpe:2.3:a:ghost:ghost:5.79.0
-
cpe:2.3:a:ghost:ghost:5.79.1
-
cpe:2.3:a:ghost:ghost:5.79.2
-
cpe:2.3:a:ghost:ghost:5.79.3
-
cpe:2.3:a:ghost:ghost:5.79.4
-
cpe:2.3:a:ghost:ghost:5.79.5
-
cpe:2.3:a:ghost:ghost:5.79.6
-
cpe:2.3:a:ghost:ghost:5.80.0
-
cpe:2.3:a:ghost:ghost:5.80.1
-
cpe:2.3:a:ghost:ghost:5.80.2
-
cpe:2.3:a:ghost:ghost:5.80.3
-
cpe:2.3:a:ghost:ghost:5.80.4
-
cpe:2.3:a:ghost:ghost:5.80.5
-
cpe:2.3:a:ghost:ghost:5.81.0
-
cpe:2.3:a:ghost:ghost:5.81.1
-
cpe:2.3:a:ghost:ghost:5.82.0
-
cpe:2.3:a:ghost:ghost:5.82.1
-
cpe:2.3:a:ghost:ghost:5.82.10
-
cpe:2.3:a:ghost:ghost:5.82.11
-
cpe:2.3:a:ghost:ghost:5.82.12
-
cpe:2.3:a:ghost:ghost:5.82.2
-
cpe:2.3:a:ghost:ghost:5.82.3
-
cpe:2.3:a:ghost:ghost:5.82.4
-
cpe:2.3:a:ghost:ghost:5.82.5
-
cpe:2.3:a:ghost:ghost:5.82.6
-
cpe:2.3:a:ghost:ghost:5.82.7
-
cpe:2.3:a:ghost:ghost:5.82.8
-
cpe:2.3:a:ghost:ghost:5.82.9
-
cpe:2.3:a:ghost:ghost:5.83.0
-
cpe:2.3:a:ghost:ghost:5.84.0
-
cpe:2.3:a:ghost:ghost:5.84.1
-
cpe:2.3:a:ghost:ghost:5.84.2
-
cpe:2.3:a:ghost:ghost:5.85.0
-
cpe:2.3:a:ghost:ghost:5.85.1
-
cpe:2.3:a:ghost:ghost:5.85.2
-
cpe:2.3:a:ghost:ghost:5.86.0
-
cpe:2.3:a:ghost:ghost:5.86.1
-
cpe:2.3:a:ghost:ghost:5.86.2
-
cpe:2.3:a:ghost:ghost:5.87.0
-
cpe:2.3:a:ghost:ghost:5.87.1
-
cpe:2.3:a:ghost:ghost:5.87.2
-
cpe:2.3:a:ghost:ghost:5.87.3
-
cpe:2.3:a:ghost:ghost:5.88.0
-
cpe:2.3:a:ghost:ghost:5.88.1
-
cpe:2.3:a:ghost:ghost:5.88.2
-
cpe:2.3:a:ghost:ghost:5.88.3
-
cpe:2.3:a:ghost:ghost:5.89.0
-
cpe:2.3:a:ghost:ghost:5.89.1
-
cpe:2.3:a:ghost:ghost:5.89.2
-
cpe:2.3:a:ghost:ghost:5.89.3
-
cpe:2.3:a:ghost:ghost:5.89.4
-
cpe:2.3:a:ghost:ghost:5.89.5
-
cpe:2.3:a:ghost:ghost:5.89.6
-
cpe:2.3:a:ghost:ghost:5.90.0
-
cpe:2.3:a:ghost:ghost:5.90.1
-
cpe:2.3:a:ghost:ghost:5.90.2
-
cpe:2.3:a:ghost:ghost:5.91.0
-
cpe:2.3:a:ghost:ghost:5.92.0
-
cpe:2.3:a:ghost:ghost:5.93.0
-
cpe:2.3:a:ghost:ghost:5.94.0
-
cpe:2.3:a:ghost:ghost:5.94.1
-
cpe:2.3:a:ghost:ghost:5.94.2
-
cpe:2.3:a:ghost:ghost:5.95.0
-
cpe:2.3:a:ghost:ghost:5.96.0
-
cpe:2.3:a:ghost:ghost:5.96.1
-
cpe:2.3:a:ghost:ghost:5.96.2
-
cpe:2.3:a:ghost:ghost:5.97.0
-
cpe:2.3:a:ghost:ghost:5.97.1
-
cpe:2.3:a:ghost:ghost:5.97.2
-
cpe:2.3:a:ghost:ghost:5.97.3
-
cpe:2.3:a:ghost:ghost:5.98.0
-
cpe:2.3:a:ghost:ghost:5.98.1
-
cpe:2.3:a:ghost:ghost:5.99.0
-
cpe:2.3:a:ghost:ghost:5.99.1
-
cpe:2.3:a:ghost:ghost:6.0.0
-
cpe:2.3:a:ghost:ghost:6.0.1
-
cpe:2.3:a:ghost:ghost:6.0.10
-
cpe:2.3:a:ghost:ghost:6.0.2
-
cpe:2.3:a:ghost:ghost:6.0.3
-
cpe:2.3:a:ghost:ghost:6.0.4
-
cpe:2.3:a:ghost:ghost:6.0.5
-
cpe:2.3:a:ghost:ghost:6.0.6
-
cpe:2.3:a:ghost:ghost:6.0.7
-
cpe:2.3:a:ghost:ghost:6.0.8
-
cpe:2.3:a:ghost:ghost:6.0.9
-
cpe:2.3:a:ghost:ghost:6.1.0
-
cpe:2.3:a:ghost:ghost:6.10.0
-
cpe:2.3:a:ghost:ghost:6.10.1
-
cpe:2.3:a:ghost:ghost:6.10.2
-
cpe:2.3:a:ghost:ghost:6.10.3
-
cpe:2.3:a:ghost:ghost:6.11.0
-
cpe:2.3:a:ghost:ghost:6.12.0
-
cpe:2.3:a:ghost:ghost:6.2.0
-
cpe:2.3:a:ghost:ghost:6.3.0
-
cpe:2.3:a:ghost:ghost:6.3.1
-
cpe:2.3:a:ghost:ghost:6.4.0
-
cpe:2.3:a:ghost:ghost:6.5.0
-
cpe:2.3:a:ghost:ghost:6.5.1
-
cpe:2.3:a:ghost:ghost:6.5.2
-
cpe:2.3:a:ghost:ghost:6.5.3
-
cpe:2.3:a:ghost:ghost:6.6.0
-
cpe:2.3:a:ghost:ghost:6.6.1
-
cpe:2.3:a:ghost:ghost:6.7.0
-
cpe:2.3:a:ghost:ghost:6.8.0
-
cpe:2.3:a:ghost:ghost:6.8.1
-
cpe:2.3:a:ghost:ghost:6.9.0
-
cpe:2.3:a:ghost:ghost:6.9.1
-
cpe:2.3:a:ghost:ghost:6.9.2
-
cpe:2.3:a:ghost:ghost:6.9.3
-
cpe:2.3:a:ghost:portal:2.29.1
-
cpe:2.3:a:ghost:portal:2.29.2
-
cpe:2.3:a:ghost:portal:2.29.3
-
cpe:2.3:a:ghost:portal:2.30.0
-
cpe:2.3:a:ghost:portal:2.30.2
-
cpe:2.3:a:ghost:portal:2.31.0
-
cpe:2.3:a:ghost:portal:2.31.1
-
cpe:2.3:a:ghost:portal:2.31.2
-
cpe:2.3:a:ghost:portal:2.32.0
-
cpe:2.3:a:ghost:portal:2.33.0
-
cpe:2.3:a:ghost:portal:2.33.1
-
cpe:2.3:a:ghost:portal:2.33.2
-
cpe:2.3:a:ghost:portal:2.33.3
-
cpe:2.3:a:ghost:portal:2.33.4
-
cpe:2.3:a:ghost:portal:2.33.5
-
cpe:2.3:a:ghost:portal:2.33.6
-
cpe:2.3:a:ghost:portal:2.33.7
-
cpe:2.3:a:ghost:portal:2.33.8
-
cpe:2.3:a:ghost:portal:2.34.0
-
cpe:2.3:a:ghost:portal:2.34.2
-
cpe:2.3:a:ghost:portal:2.34.3
-
cpe:2.3:a:ghost:portal:2.34.4
-
cpe:2.3:a:ghost:portal:2.35.0
-
cpe:2.3:a:ghost:portal:2.35.1
-
cpe:2.3:a:ghost:portal:2.35.2
-
cpe:2.3:a:ghost:portal:2.36.0
-
cpe:2.3:a:ghost:portal:2.36.1
-
cpe:2.3:a:ghost:portal:2.36.2
-
cpe:2.3:a:ghost:portal:2.36.3
-
cpe:2.3:a:ghost:portal:2.36.4
-
cpe:2.3:a:ghost:portal:2.36.5
-
cpe:2.3:a:ghost:portal:2.37.0
-
cpe:2.3:a:ghost:portal:2.37.1
-
cpe:2.3:a:ghost:portal:2.37.10
-
cpe:2.3:a:ghost:portal:2.37.2
-
cpe:2.3:a:ghost:portal:2.37.3
-
cpe:2.3:a:ghost:portal:2.37.4
-
cpe:2.3:a:ghost:portal:2.37.5
-
cpe:2.3:a:ghost:portal:2.37.6
-
cpe:2.3:a:ghost:portal:2.37.7
-
cpe:2.3:a:ghost:portal:2.37.8
-
cpe:2.3:a:ghost:portal:2.37.9
-
cpe:2.3:a:ghost:portal:2.38.0
-
cpe:2.3:a:ghost:portal:2.39.0
-
cpe:2.3:a:ghost:portal:2.40.0
-
cpe:2.3:a:ghost:portal:2.41.0
-
cpe:2.3:a:ghost:portal:2.42.0
-
cpe:2.3:a:ghost:portal:2.42.1
-
cpe:2.3:a:ghost:portal:2.42.2
-
cpe:2.3:a:ghost:portal:2.42.3
-
cpe:2.3:a:ghost:portal:2.43.0
-
cpe:2.3:a:ghost:portal:2.43.1
-
cpe:2.3:a:ghost:portal:2.43.2
-
cpe:2.3:a:ghost:portal:2.44.0
-
cpe:2.3:a:ghost:portal:2.44.1
-
cpe:2.3:a:ghost:portal:2.45.0
-
cpe:2.3:a:ghost:portal:2.45.1
-
cpe:2.3:a:ghost:portal:2.46.0
-
cpe:2.3:a:ghost:portal:2.46.1
-
cpe:2.3:a:ghost:portal:2.46.2
-
cpe:2.3:a:ghost:portal:2.47.0
-
cpe:2.3:a:ghost:portal:2.47.1
-
cpe:2.3:a:ghost:portal:2.48.0
-
cpe:2.3:a:ghost:portal:2.48.1
-
cpe:2.3:a:ghost:portal:2.48.2
-
cpe:2.3:a:ghost:portal:2.48.3
-
cpe:2.3:a:ghost:portal:2.49.0
-
cpe:2.3:a:ghost:portal:2.49.1
-
cpe:2.3:a:ghost:portal:2.49.2
-
cpe:2.3:a:ghost:portal:2.49.3
-
cpe:2.3:a:ghost:portal:2.50.0
-
cpe:2.3:a:ghost:portal:2.50.1
-
cpe:2.3:a:ghost:portal:2.50.2
-
cpe:2.3:a:ghost:portal:2.50.3
-
cpe:2.3:a:ghost:portal:2.50.4
-
cpe:2.3:a:ghost:portal:2.50.5
-
cpe:2.3:a:ghost:portal:2.50.6
-
cpe:2.3:a:ghost:portal:2.50.7
-
cpe:2.3:a:ghost:portal:2.50.8
-
cpe:2.3:a:ghost:portal:2.50.9
-
cpe:2.3:a:ghost:portal:2.51.0
-
cpe:2.3:a:ghost:portal:2.51.1
-
cpe:2.3:a:ghost:portal:2.51.2
-
cpe:2.3:a:ghost:portal:2.51.3
-
cpe:2.3:a:ghost:portal:2.51.4
-
cpe:2.3:a:ghost:portal:2.52.0
-
cpe:2.3:a:ghost:portal:2.53.0
-
cpe:2.3:a:ghost:portal:2.53.1
-
cpe:2.3:a:ghost:portal:2.53.2
-
cpe:2.3:a:ghost:portal:2.53.3
-
cpe:2.3:a:ghost:portal:2.54.0
-
cpe:2.3:a:ghost:portal:2.55.0
-
cpe:2.3:a:ghost:portal:2.55.1
-
cpe:2.3:a:ghost:portal:2.55.2
-
cpe:2.3:a:ghost:portal:2.55.3
-
cpe:2.3:a:ghost:portal:2.55.4
-
cpe:2.3:a:ghost:portal:2.55.5
-
cpe:2.3:a:ghost:portal:2.56.0
-
cpe:2.3:a:ghost:portal:2.56.1
-
cpe:2.3:a:ghost:portal:2.56.2
-
cpe:2.3:a:ghost:portal:2.56.3
-
cpe:2.3:a:ghost:portal:2.56.4
-
cpe:2.3:a:ghost:portal:2.57.0