Every CVESearch/Get API key

GHSA-w8fq-xgvh-cxc2

Silverstripe Forum Module CSRF Vulnerability

5.3 MediumFix available

A number of form actions in the Forum module are directly accessible. A malicious user (e.g. spammer) can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures.

Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting in a topic being moved.

Thanks to Michael Strong for discovering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score used5.3

Silverstripe Forum Module CSRF Vulnerability

A number of form actions in the Forum module are directly accessible. A malicious user (e.g. spammer) can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures.

Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting in a topic being moved.

Thanks to Michael Strong for discovering.

Record
GHSA-w8fq-xgvh-cxc2
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-352, CWE-425
Updated
2026-11-02
OSV5.3

Silverstripe Forum Module CSRF Vulnerability

A number of form actions in the Forum module are directly accessible. A malicious user (e.g. spammer) can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures.

Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting in a topic being moved.

Thanks to Michael Strong for discovering.

Record
GHSA-w8fq-xgvh-cxc2
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-352, CWE-425
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/forum
Packagist
through 0.6.1
0.6.2
silverstripe/forum
Packagist
0.7.0 to 0.7.3
0.7.4
silverstripe/forum
Packagist
before 0.6.2, plus listed versions
0.4.10.5.10.6.00.6.1
0.6.2
silverstripe/forum
Packagist
0.7.0 up to 0.7.4, plus listed versions
0.7.10.7.20.7.3
0.7.4

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-w8fq-xgvh-cxc2 is a medium vulnerability (CVSS 5.3) in silverstripe/forum, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/forum 0.6.2.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open