CVE-2026-103285 describes a CSRF vulnerability in the TryGhost Ghost platform affecting versions >=5.19.0 and <6.57.1. The vulnerability exists in the post feedback functionality, enabling attackers to cause authenticated users to unknowingly submit feedback by visiting a maliciously crafted URL. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited impact on integrity.

An attacker can induce authenticated users to submit feedback without their knowledge or consent, potentially leading to unauthorized actions being performed in the context of the victim's session. There is no indication of privilege escalation or data disclosure beyond the feedback submission.

Users should upgrade Ghost to version 6.57.1 or later where this vulnerability is fixed. Since this is a software vulnerability and not a cloud service, patching the affected versions is necessary to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.