Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Flarum Framework 1.8.16 Clear all filters
TI-2026-28793 CVE-2026-39924 · GHSA-4x2h-wcjq-p974

Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Priority LOW 33

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_to…

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00373 Published 2026-08-05 Fixed in 1.8.16 CWE-613
TI-2026-28792 CVE-2026-39923 · GHSA-3mr9-883x-4f3x

Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Priority MEDIUM 42

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00428 Published 2026-08-05 Fixed in 1.8.16 CWE-324