Which versions of Flarum are affected by EUVD-2026-53392?

Flarum before v1.8.16 contains a privilege persistence flaw where attackers who obtain any valid user session can maintain indefinite access even after the victim resets their password, rendering…. A patch is available.

How to fix or mitigate EUVD-2026-53392?

Within 24 hours: conduct a complete inventory of Flarum deployments and document all version numbers to identify instances running before v1.8.16. Within 7 days: deploy v1.8.16 to all affected instances and execute a system-wide session invalidation (clearing access_tokens and RememberAccessToken entries for all users), followed by a mandatory password reset; note that password reset alone without session clearing will not remove the attacker. Within 30 days: perform forensic analysis of access logs from the pre-patch period to identify unauthorized account activity, and implement session anomaly detection going forward.

Flarum EUVD-2026-53392

Q: What is the CVSS score of EUVD-2026-53392?

EUVD-2026-53392 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-39924 HIGH

Insufficient Session Expiration (CWE-613)

2026-08-05 VulnCheck

GHSA-4x2h-wcjq-p974

Information Disclosure Flarum Flarum Framework

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

AV:N for remote exploitation via network token reuse; AC:H for mandatory prior session token acquisition; PR:L for required authenticated session; no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 15:46 vuln.today

Analysis Generated

Aug 05, 2026 - 15:46 vuln.today

CVE Published

Aug 05, 2026 - 14:40 cve.org

HIGH 7.6

DescriptionCVE.org

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

AnalysisAI

Session persistence after password change in Flarum before 1.8.16 allows an attacker who already holds a valid session token to maintain full account access indefinitely, even after the victim resets their password. The TokensClearer::clearPasswordTokens() function clears only the password_tokens table and never touches the access_tokens table, so all active session cookies, API bearer tokens, and long-lived RememberAccessToken entries survive both user-initiated and administrator-forced password resets. No public exploit has been identified at time of analysis; vendor-released patch v1.8.16 resolves the issue.

Technical ContextAI

Flarum is a PHP-based open-source forum framework (CPE: cpe:2.3:a:flarum:flarum_framework:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-613 (Insufficient Session Expiration): Flarum maintains two logically separate database stores - password_tokens for password-reset flow tokens and access_tokens for active authenticated sessions including persistent 'remember me' entries (RememberAccessToken). The password change event handler invokes TokensClearer::clearPasswordTokens(), which exclusively targets the password_tokens table. Because the access_tokens table is never cleared on credential change, any session token or API bearer token obtained by an attacker prior to the password reset remains cryptographically valid and grants full authenticated API access indefinitely. This flaw applies equally to administrator-forced password resets issued via the user update endpoint, meaning the standard administrative remediation path is also ineffective.

RemediationAI

Upgrade Flarum to version 1.8.16 or later, available at https://github.com/flarum/framework/releases/tag/v1.8.16. This release includes PR #4546 (commit 5f080293a029d0d273eb9678d597c74ea86a3bcc) which specifically fixes the access_tokens table not being cleared on password change. The same release also addresses a related expiry-check bypass on password reset token submission (PR #4545) and stale token cleanup (PR #4547), making the full upgrade strongly advisable over cherry-picking individual fixes. If immediate upgrade is not possible, a targeted compensating control is to manually delete all rows from the access_tokens table in the Flarum database for any user account suspected of compromise - note this will log out all of that user's active sessions including legitimate ones. Forum-wide deletion of all access_tokens rows is a more disruptive but effective interim measure that forces all users to re-authenticate; the trade-off is operational disruption to all active sessions.