Read the docs

flarum

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

flarum records in CISA KEV

No flarum vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Flarum 12 records HIGH Sticky 1 record LOW

Records

20 records

TI-2021-12339 CVE-2021-32671 · GHSA-5qjq-69w6-fg57

XSS vulnerability with translator

Priority HIGH 70

Flarum is a forum software for building communities.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.4 Published 2021-06-07 Fixed in 1.0.2 CWE-79
TI-2026-28792 CVE-2026-39923 · GHSA-3mr9-883x-4f3x

Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Priority MEDIUM 42

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00428 Published 2026-08-05 Fixed in 1.8.16 CWE-324
TI-2026-76491 CVE-2026-112291 · GHSA-6p4m-p9g8-5x3c

Missing authorization in Flarum Extension Manager task API exposes data

Priority LOW 36

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00346 Published 2026-10-19 Fixed in 2.0.0-beta.8 CWE-862
TI-2026-28793 CVE-2026-39924 · GHSA-4x2h-wcjq-p974

Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Priority LOW 33

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_to…

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00373 Published 2026-08-05 Fixed in 1.8.16 CWE-613
TI-2024-14366 CVE-2024-21641 · GHSA-733r-8xcp-w9mr

Flarum's Logout Route allows open redirects

Priority LOW 31

Flarum is open source discussion platform software.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01067 Published 2024-01-05 Fixed in 1.8.5 CWE-601
TI-2024-38399 CVE-2024-58302 · GHSA-54q9-c4j4-jf82

FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings

Priority LOW 30

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00336 Published 2025-12-11 No fix listed CWE-98
TI-2023-08737 CVE-2023-22488 · GHSA-8gcg-vwmw-rxj4

Missing authorization in Flarum

Priority LOW 30

Flarum is a forum software for building communities.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00416 Published 2023-01-12 Fixed in 1.6.3 CWE-862
TI-2021-04383 CVE-2021-21283 · GHSA-h3gg-7wx2-cq3h

XSS in Flarum Sticky extension.

Priority LOW 26

Flarum is an open source discussion platform for websites.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00797 Published 2021-01-26 Fixed in 0.1.0-beta.15.1 CWE-79
Open these records in search →