{"id":"CVE-2026-30913","aliases":["EUVD-2026-10422","GHSA-3c4m-j3g4-hh25"],"status":"published","title":"flarum/nickname: Display name injection in notification emails (autolink \u0026 markdown)","description":"Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00197,"percentile":0.09524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-03-09T22:42:40Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Packagist","package":"flarum/nicknames","fixed_in":["1.8.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"flarum/nicknames","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"flarum/nicknames","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3"}]}],"versions":["0.1.0-beta.16.1","v0.1.0-beta.15","v0.1.0-beta.16","v1.0.0","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.5.0","v1.6.0","v1.6.1","v1.7.0","v1.8.0","v1.8.1","v1.8.2"]}],"products":[{"vendor":"flarum","product":"nicknames"}],"references":[{"url":"https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/flarum/nicknames/releases/tag/v1.8.","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/flarum/nicknames/releases/tag/v1.8.3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30913","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3c4m-j3g4-hh25"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30913.json","tags":["advisory"]},{"url":"https://github.com/flarum/framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-30913","title":"flarum/nickname: Display name injection in notification emails (autolink \u0026 markdown)","description":"Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.","status":"published","published":"2026-03-09T22:42:40.014Z","modified":"2026-03-10T14:17:30.046Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-10422","description":"Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.","status":"published","published":"2026-03-09T22:42:40Z","modified":"2026-03-10T14:17:30Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:05.412027Z"}],"ghsa":[{"id":"GHSA-3c4m-j3g4-hh25","title":"flarum/nicknames extension has display name injection in notification emails (autolink \u0026 markdown)","description":"## Summary\n\nWhen the `flarum/nicknames` extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.\n\n## Affected package\n\n- **`flarum/nicknames`** — permissive display name driver that allows special characters; affected since initial release on the `1.x` branch\n\nAny third-party display name driver that permits special characters would be equally affected.\n\n## Variants\n\n1. **Domain autolink** — a nickname such as `nasty.com` is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird).\n2. **Markdown link syntax** — a nickname such as `[CLICK](https://evil.com)` is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).\n\n## Steps to reproduce\n\n**Variant 1 (autolink — affects all email clients)**\n1. Enable `flarum/nicknames`, set nickname to `nasty.com`\n2. Trigger a notification email to another user (e.g. follow them, mention them)\n3. The nickname appears as a clickable link in the received email\n\n**Variant 2 (markdown — affects markdown-rendering email clients)**\n1. Enable `flarum/nicknames`, set nickname to `[CLICK](https://evil.com)`\n2. Trigger a notification email to another user\n3. In a markdown-rendering email client (e.g. Apple Mail), the nickname appears as a clickable link\n\n## Impact\n\nPhishing / social engineering: victims may be misled into visiting attacker-controlled URLs via links appearing to originate from a trusted platform notification email. Variant 1 is exploitable against virtually all email clients without any special conditions.\n\n- CVSS v3.1: `AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N` — **4.6 Medium**\n\n## Root cause\n\nThe default username-based display name driver constrains values to `[a-zA-Z0-9_-]+`, making it immune. `flarum/nicknames` introduced permissive validation (min/max length and an optional admin-configured regex) that allows arbitrary characters including those meaningful in URL and markdown contexts. This has been the case since the first commit of the extension.\n\n## Proposed fix\n\n- Add validation in `flarum/nicknames` to reject or sanitize nicknames containing characters that email clients may interpret as URLs or markdown links\n- Alternatively, sanitize the display name before insertion into notification email bodies so that legitimate nicknames like `Jane.Smith` are preserved but rendered safely\n\n## References\n\n- Bug bounty submission: SBB-L4ZVAFH8 (Intigriti)","status":"published","published":"2026-03-10T00:56:30Z","modified":"2026-03-10T18:44:20Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:33.538417Z"}],"nvd":[{"id":"CVE-2026-30913","description":"Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.","status":"published","published":"2026-03-10T17:40:15.21Z","modified":"2026-06-17T10:33:08.41Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-30913","title":"flarum/nickname: Display name injection in notification emails (autolink \u0026 markdown)","description":"Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.","status":"published","published":"2026-03-09T22:42:40.014Z","modified":"2026-10-28T02:31:00.750389466Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:00.861953Z"},{"id":"GHSA-3c4m-j3g4-hh25","title":"flarum/nicknames extension has display name injection in notification emails (autolink \u0026 markdown)","description":"## Summary\n\nWhen the `flarum/nicknames` extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.\n\n## Affected package\n\n- **`flarum/nicknames`** — permissive display name driver that allows special characters; affected since initial release on the `1.x` branch\n\nAny third-party display name driver that permits special characters would be equally affected.\n\n## Variants\n\n1. **Domain autolink** — a nickname such as `nasty.com` is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird).\n2. **Markdown link syntax** — a nickname such as `[CLICK](https://evil.com)` is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).\n\n## Steps to reproduce\n\n**Variant 1 (autolink — affects all email clients)**\n1. Enable `flarum/nicknames`, set nickname to `nasty.com`\n2. Trigger a notification email to another user (e.g. follow them, mention them)\n3. The nickname appears as a clickable link in the received email\n\n**Variant 2 (markdown — affects markdown-rendering email clients)**\n1. Enable `flarum/nicknames`, set nickname to `[CLICK](https://evil.com)`\n2. Trigger a notification email to another user\n3. In a markdown-rendering email client (e.g. Apple Mail), the nickname appears as a clickable link\n\n## Impact\n\nPhishing / social engineering: victims may be misled into visiting attacker-controlled URLs via links appearing to originate from a trusted platform notification email. Variant 1 is exploitable against virtually all email clients without any special conditions.\n\n- CVSS v3.1: `AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N` — **4.6 Medium**\n\n## Root cause\n\nThe default username-based display name driver constrains values to `[a-zA-Z0-9_-]+`, making it immune. `flarum/nicknames` introduced permissive validation (min/max length and an optional admin-configured regex) that allows arbitrary characters including those meaningful in URL and markdown contexts. This has been the case since the first commit of the extension.\n\n## Proposed fix\n\n- Add validation in `flarum/nicknames` to reject or sanitize nicknames containing characters that email clients may interpret as URLs or markdown links\n- Alternatively, sanitize the display name before insertion into notification email bodies so that legitimate nicknames like `Jane.Smith` are preserved but rendered safely\n\n## References\n\n- Bug bounty submission: SBB-L4ZVAFH8 (Intigriti)","status":"published","published":"2026-03-10T00:56:30Z","modified":"2026-03-10T18:47:25.701417Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}