CVE-2026-48780

Katalog CVE

CVSS 8.2 · High EPSS 0,37%

Kerentanan Improper Authentication. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.

Rincian

Terbit di NVD

16 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/forem/forem/commit/a2ab6d409d2676eb0711ecbd737192043125b437
• https://github.com/forem/forem/security/advisories/GHSA-3g4h-9h37-mpx6