What is the CVSS score of CVE-2026-48780?

CVE-2026-48780 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Forem are affected by CVE-2026-48780?

Forem instances using email domain restrictions to control user registration are vulnerable to account creation bypass, allowing attackers to register accounts that circumvent intended access…

How to fix or mitigate CVE-2026-48780?

Within 24 hours: Identify all Forem instances in production and audit recent user registrations for suspicious accounts; disable self-service registration if operationally feasible and implement manual account provisioning as interim control. Within 7 days: Contact Forem maintainers to establish patch timeline; configure email domain validation at reverse proxy or Web Application Firewall layer; document all account creation activity during exposure period. Within 30 days: Deploy vendor-released patch immediately upon availability; remove unauthorized accounts created during vulnerability window; if no patch timeline provided, evaluate Forem security fork or alternative platforms with native email domain validation.

Forem CVE-2026-48780

EUVD-2026-37120 HIGH

Improper Authentication (CWE-287)

2026-06-16 GitHub_M

Authentication Bypass Forem

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Remote unauthenticated bypass via registration endpoint; impact is unauthorized access to a gated community (limited confidentiality and integrity, no high-value data class guaranteed), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 16, 2026 - 15:23 vuln.today

Analysis Generated

Jun 16, 2026 - 15:23 vuln.today

DescriptionCVE.org

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.

AnalysisAI

Authentication bypass in Forem (prior to commit a2ab6d4) allows remote attackers to circumvent email domain allowlist/denylist controls by submitting RFC 2047 encoded-word email addresses, enabling unauthorized registration on invite-only deployments. The flaw arises because the raw email string passes domain checks while downstream mail decoding resolves it to an attacker-controlled address, with no public exploit identified at time of analysis.

Technical ContextAI

Forem is a Ruby on Rails platform powering community forums (notably dev.to). The vulnerability stems from inconsistent email parsing: domain allowlist/denylist logic in Settings::Authentication.acceptable_domain? evaluates the raw RFC 5322 domain portion (e.g., 'company.com'), while the Mail gem's Mail::Encodings.value_decode rewrites RFC 2047 encoded-word local parts such as '=?utf-8?q?test=40attacker.com=3e?=@company.com' into 'test@attacker.com>@company.com', producing a different effective recipient. This is a classic CWE-287 authentication bypass via parser differential - the validator and the consumer disagree on what the email string means. The patch (commit a2ab6d409d2676eb0711ecbd737192043125b437) adds a reject_encoded_word_email ActiveRecord validation on the User model that flags any address matching the encoded-word regex /=\?[^?]+\?[BbQq]\?[^?]+\?=/.

RemediationAI

Upstream fix available (commit a2ab6d409d2676eb0711ecbd737192043125b437); released patched version not independently confirmed, so self-hosted operators should rebuild/redeploy Forem from main at or after that commit per https://github.com/forem/forem/commit/a2ab6d409d2676eb0711ecbd737192043125b437 and the advisory at https://github.com/forem/forem/security/advisories/GHSA-3g4h-9h37-mpx6. As a stopgap before redeploying, add an application- or proxy-layer filter that rejects registration, magic-link, and OAuth callback requests whose email field matches the RFC 2047 encoded-word pattern /=\?[^?]+\?[BbQq]\?[^?]+\?=/, accepting that legitimate users with unusual but valid local parts containing literal '=?' sequences could be falsely blocked. Operators may also lean on the vendor-noted workaround that many SMTP providers drop encoded-word recipients, but this is unreliable and should not be the sole control. Monitor user creation logs for any addresses containing '=?' and '?=' substrings to detect prior exploitation.