EUVD-2026-61141Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Public endpoint requires no authentication (PR:N); payload executes in admin security context constituting scope change (S:C); CSRF and session abuse enable full admin integrity impact (I:H).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
AnalysisAI
Stored cross-site scripting in Forem's admin abuse-report panel allows a remote unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. The public FeedbackMessagesController previously accepted an attacker-supplied offender_id parameter, which caused the unsanitized message field to be rendered via Rails' raw() helper when an administrator views the flagged report - exposing CSRF tokens, session data, and enabling unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable rendering path in the admin view fires only when the FeedbackMessage record has a non-null offender_id. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 6.3 with PR:L (low privileges required) is inconsistent with the advisory description, which explicitly states the public FeedbackMessagesController accepts abuse reports without any authorization - the submission step is unauthenticated, suggesting PR:N would be more accurate and would yield a materially higher base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Forem to a build incorporating commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, which removes offender_id from FEEDBACK_ALLOWED_PARAMS, replaces raw(feedback_message.message) with auto-escaping ERB output in the admin partial, and derives offender identity server-side from the submitted reported_url. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today