CVE-2026-61696
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Forem before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c stores an unsanitized value from feedback_message[message] and renders it via raw() in the admin view when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser, potentially exposing sensitive in-page data, CSRF tokens, or performing administrative actions. The public FeedbackMessagesController accepts the report without authorization and previously allowed a submitted offender_id, making the vulnerable path reachable by an unauthenticated attacker.
Risk Assessment
An unauthenticated attacker can hijack an administrator's session, execute arbitrary JavaScript, and potentially take over the community.
Recommendation
Update Forem to a version containing commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c or later.
Other vulnerabilities in Forem
See all- CVE-2026-48780High
Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments.
- CVE-2023-27160High
An SSRF vulnerability in forem up to v2022.11.11 allows an attacker to send a crafted POST request to the /articles/{id} endpoint, enabling access to network resources and sensitive information.
Original NVD description (English source)
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
Vulnerability data from NVD (NIST) · CISA KEV · EPSS