CVE-2026-61696Forem: Stored XSS in Admin Abuse Report Rendering
Updated under an hour ago ()
Does this affect you?
It affects forem. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
- CVSS
- 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
- Weakness (CWE)
- CWE-74, CWE-79, CWE-116
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Aug 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
forem forem forem:forem (from the name) | before 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c | CNA record |
References
- https://github.com/forem/forem/security/advisories/GHSA-4463-499m-94mxx-refsource-confirm
- https://github.com/forem/forem/commit/92eacd16a82cf9007ba8e16a2258b42e3b53ca9cx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.