ElkArte Forum CVE-2026-72553

Exploitation requires: (1) the attacker holds a valid registered member account on the target ElkArte instance (PR:L - low-privilege authenticated access); (2) the cust_blurb or cust_locate custom profile fields are enabled and writable for regular members; (3) an administrator must actively view the attacker's profile page, either through direct navigation or routine moderation (UI:R). What limits exploitation: closed-registration forums that require admin approval for new accounts significantly raise the barrier; administrators who never view individual member profiles outside of specific moderation events reduce the chance of trigger; the flaw does not enable direct server-side code execution and has no availability impact. No network-level restrictions limit the initial registration step - the forum must simply be reachable over the internet.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores 5.4 (Medium), which reasonably reflects the attack requirements: a registered account (PR:L) and an administrator who views the malicious profile (UI:R). The scope change (S:C) is the distinguishing factor - impact is not confined to the attacker's own session but crosses into an administrator's session, enabling privilege escalation. No EPSS data was provided in the source intelligence, and CISA KEV status is absent, indicating no confirmed active exploitation at time of analysis. The real-world priority is moderate: open-registration forums face higher exposure because any user can weaponize the flaw, whereas invite-only or closed communities are largely protected by the PR:L prerequisite. The medium CVSS score is not an artifact of inflated ratings here - it accurately reflects that UI:R and PR:L genuinely limit blast radius compared to unauthenticated, no-interaction attacks.

An attacker registers a standard member account on the target ElkArte forum and submits a JavaScript payload (e.g., a cookie-stealing script posting to an attacker-controlled endpoint) into the cust_blurb or cust_locate profile fields. When an administrator views the attacker's profile page - a routine moderation task - the unescaped script executes in the administrator's browser session, exfiltrating the admin's session token or performing privileged forum actions on their behalf. No public proof-of-concept code has been identified, but the attack technique is well-understood and trivially constructible from the description alone.