CVE-2020-5502

phpBB allows CSRF

6.5 MediumFix available

CVE-2020-5502 is a medium vulnerability (CVSS 6.5) in Phpbb, published January 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in phpbb/phpbb 3.2.9.

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.43%Down 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: CVE-2020-5502
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: CVE-2020-5502
Updated: 2026-11-02

EUVDEUVD-2022-2764 No score

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: EUVD-2022-2764
Updated: 2026-11-03

GitHub AdvisoriesGHSA-69q7-hww4-8pjq 6.5

phpBB allows CSRF

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: GHSA-69q7-hww4-8pjq
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSV 6.5

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: CVE-2020-5502
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-69q7-hww4-8pjq 6.5

phpBB allows CSRF

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: GHSA-69q7-hww4-8pjq
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVBIT-phpbb-2020-5502 No score

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Record: BIT-phpbb-2020-5502
Updated: 2026-11-02

Affected products

phpbb

Affected packages

Affected packages
Package	Affected	Fixed
`phpbb/phpbb` Packagist	through 3.2.8	3.2.9
`phpbb` Bitnami	3.2.8 to 3.2.8	None known
`phpbb/phpbb` Packagist	before 3.2.9, plus listed versions 3.0.123.0.12-RC13.0.12-RC23.0.12-RC33.0.13 Show 45 moreShow less 3.0.13-PL13.0.13-RC13.0.143.0.14-RC13.1.03.1.0-RC13.1.0-RC23.1.0-RC33.1.0-RC43.1.0-RC53.1.0-RC63.1.0-a13.1.0-a23.1.0-a33.1.0-b13.1.0-b23.1.0-b33.1.0-b43.1.13.1.103.1.10-RC13.1.113.1.11-RC13.1.123.1.23.1.2-RC13.1.33.1.3-RC13.1.3-RC23.1.43.1.4-RC13.1.4-RC23.1.53.1.5-RC13.1.63.1.6-RC13.1.73.1.7-RC13.1.7-pl13.1.83.1.8-RC13.1.93.1.9-RC13.2.03.2.0-RC1	3.2.9

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 21 versions. The JSON record has them.