Read the docs
TI-2019-10049 Aliases CVE-2019-13376GHSA-6mh2-98gr-wv76

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by…

Priority LOW 30CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering, Cross-site scripting
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-79.

Summary

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

Why it matters now

EPSS 0.00678 52nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed phpbb/phpbb (Packagist): 3.2.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—phpbb/phpbb (Packagist)before 3.2.83.2.8Patch availableGHSA-6mh2-98gr-wv76
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • phpbb/phpbb (Packagist) Vendor— Affected before 3.2.8 Fixed in 3.2.8 Patch available GHSA-6mh2-98gr-wv76

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:phpbb:phpbb:3.2.7:*:*:*:*:*:*:*3.2.7VulnerablephpBB
  • cpe:2.3:a:phpbb:phpbb:3.2.7:*:*:*:*:*:*:* Versions 3.2.7 Vulnerable ·phpBB

Remediation

  • Fix · GHSA-6mh2-98gr-wv76 phpbb/phpbb (Packagist) Fixed in 3.2.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13376
  2. 2026-10-03 Alias added: GHSA-6mh2-98gr-wv76

References

Exploit 2

Advisory 1

Other 2

  • TI-2025-43137 Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker… CVSS 3.1HIGH 8.8
  • TI-2001-01423 prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute… CVSS 3.1HIGH 8.8
  • TI-2008-03086 Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors… CVSS 2.0HIGH 10.0
  • TI-2008-01694 Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack… CVSS 2.0HIGH 10.0
  • TI-2006-06909 PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module… CVSS 2.0HIGH 7.5
  • TI-2019-12678 In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a… CVSS 3.1HIGH 8.8
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences