CVE-2026-48780
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments.
Risk Assessment
Organizations may be exposed to unauthorized access to their Forem deployments, potentially leading to data leaks or breaches of user privacy.
Recommendation
It is recommended to update the software to the version containing the a2ab6d4 patch and consider implementing additional security measures at the SMTP server level.
Other vulnerabilities in Forem
See all- CVE-2026-61696Medium
Forem before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c stores an unsanitized value from feedback_message[message] and renders it via raw() in the admin view when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser, potentially exposing sensitive in-page data, CSRF tokens, or performing administrative actions. The public FeedbackMessagesController accepts the report without authorization and previously allowed a submitted offender_id, making the vulnerable path reachable by an unauthenticated attacker.
- CVE-2023-27160High
An SSRF vulnerability in forem up to v2022.11.11 allows an attacker to send a crafted POST request to the /articles/{id} endpoint, enabling access to network resources and sensitive information.
Original NVD description (English source)
Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.