Vulnerabilities

TI-2026-62240 CVE-2026-92161 · GHSA-g7vj-c29h-3h5m

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

MEDIUM 49

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00272 Published 2026-09-25 Fixed in 1.7.4, 2.0.0-beta.4 CWE-345

TI-2022-16348 CVE-2022-35921 · GHSA-6gjm-6wj6-4px5

LOW 21

fof/byobu is a private discussions extension for Flarum forum.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0053 Published 2022-08-01 Fixed in 1.1.7 CWE-269

TI-2022-13045 CVE-2022-30999 · GHSA-fm53-mpmp-7qw2

HIGH 73

FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01263 Published 2022-05-25 Fixed in 1.2.3 CWE-79