ZeroDay Findings
Sign inSign up

Findings

CVE-2026-30913

Flarum is open-source forum software.

Published Mar 10, 2026 · updated Jun 17, 2026

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 10, 2026 · NIST NVD

    Detected

    Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

  2. Jun 17, 2026 · NIST NVD

    Updated

    Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

Sources

  • CVE.orgVulnerability recordCVE-2026-30913

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-30913

    Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be mis

    nvd.nist.gov

References