CVE-2024-21641
Flarum's Logout Route allows open redirects
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Flarum's Logout Route allows open redirects
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.
- Record
CVE-2024-21641- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2024-0279
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.
- Record
EUVD-2024-0279- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-733r-8xcp-w9mr
Flarum's logout Route allows open redirects
Impact
The Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. Sample: example.com/logout?return=https://google.com. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation.
Some ecosystem extensions modifying the logout route have already been affected. Sample: https://discuss.flarum.org/d/22229-premium-wordpress-integration/526
Patches
The vulnerability has been fixed and published as flarum/core v1.8.5. All communities running Flarum should upgrade as soon as possible to v1.8.5 using:
composer update --prefer-dist --no-dev -a -W
You can then confirm you run the latest version using:
composer show flarum/core
Workarounds
Some extensions modifying the logout route can remedy this issue if their implementation is safe. In any case we recommend updating to 1.8.5.
References
For any questions or comments on this vulnerability, please visit https://discuss.flarum.org/
For support questions, create a discussion at https://discuss.flarum.org/t/support.
A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [email protected], and we will address it promptly.
- Record
GHSA-733r-8xcp-w9mr- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.
- Record
CVE-2024-21641- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Flarum's Logout Route allows open redirects
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.
- Record
CVE-2024-21641- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-733r-8xcp-w9mr
Flarum's logout Route allows open redirects
Impact
The Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. Sample: example.com/logout?return=https://google.com. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation.
Some ecosystem extensions modifying the logout route have already been affected. Sample: https://discuss.flarum.org/d/22229-premium-wordpress-integration/526
Patches
The vulnerability has been fixed and published as flarum/core v1.8.5. All communities running Flarum should upgrade as soon as possible to v1.8.5 using:
composer update --prefer-dist --no-dev -a -W
You can then confirm you run the latest version using:
composer show flarum/core
Workarounds
Some extensions modifying the logout route can remedy this issue if their implementation is safe. In any case we recommend updating to 1.8.5.
References
For any questions or comments on this vulnerability, please visit https://discuss.flarum.org/
For support questions, create a discussion at https://discuss.flarum.org/t/support.
A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [email protected], and we will address it promptly.
- Record
GHSA-733r-8xcp-w9mr- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flarum/corePackagist |
before 1.8.5 | 1.8.5 |
flarum/frameworkPackagist |
before 1.8.5 | 1.8.5 |
flarum/corePackagist |
before 1.8.5, plus listed versions v0.1.0-betav0.1.0-beta.10v0.1.0-beta.11v0.1.0-beta.11.1v0.1.0-beta.12 Show 43 moreShow lessv0.1.0-beta.13v0.1.0-beta.14v0.1.0-beta.14.1v0.1.0-beta.15v0.1.0-beta.16v0.1.0-beta.2v0.1.0-beta.3v0.1.0-beta.4v0.1.0-beta.5v0.1.0-beta.6v0.1.0-beta.7v0.1.0-beta.7.1v0.1.0-beta.7.2v0.1.0-beta.8v0.1.0-beta.8.1v0.1.0-beta.8.2v0.1.0-beta.9v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4v1.1.0v1.1.1v1.2.0v1.2.1v1.3.0v1.3.1v1.4.0v1.4.1v1.5.0v1.6.0v1.6.1v1.6.2v1.6.3v1.7.0v1.7.1v1.7.2v1.8.0v1.8.1v1.8.2v1.8.3v1.8.4 |
1.8.5 |
flarum/frameworkPackagist |
before 1.8.5, plus listed versions v0.1.0-betav0.1.0-beta.10v0.1.0-beta.11v0.1.0-beta.11.1v0.1.0-beta.12 Show 40 moreShow lessv0.1.0-beta.13v0.1.0-beta.14v0.1.0-beta.14.1v0.1.0-beta.15v0.1.0-beta.16v0.1.0-beta.2v0.1.0-beta.3v0.1.0-beta.4v0.1.0-beta.5v0.1.0-beta.6v0.1.0-beta.7v0.1.0-beta.7.1v0.1.0-beta.7.2v0.1.0-beta.8v0.1.0-beta.8.1v0.1.0-beta.8.2v0.1.0-beta.9v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4v1.1.0v1.1.1v1.2.0v1.2.1v1.3.0v1.3.1v1.4.0v1.5.0v1.6.0v1.6.1v1.6.2v1.6.3v1.7.0v1.7.1v1.8.0v1.8.1v1.8.2v1.8.3 |
1.8.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Flarum < 1.8.5 - Open Redirect |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21641 is a medium vulnerability (CVSS 6.5) in Flarum, published January 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 64th percentile. Fixed in flarum/core 1.8.5.
References
github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr
nvd.nist.gov/vuln/detail/CVE-2024-21641