{"id":"CVE-2026-48780","aliases":["EUVD-2026-37120","GHSA-3g4h-9h37-mpx6"],"status":"published","title":"Forem vulnerable to bypass of email address domain restrictions","description":"Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00218,"percentile":0.12411,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-06-16T14:10:27Z","modified":"2026-10-28T02:30:22Z","products":[{"vendor":"forem","product":"forem"}],"references":[{"url":"https://github.com/forem/forem/security/advisories/GHSA-3g4h-9h37-mpx6","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/forem/forem/commit/a2ab6d409d2676eb0711ecbd737192043125b437","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48780.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48780","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-48780","title":"Forem vulnerable to bypass of email address domain restrictions","description":"Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.","status":"published","published":"2026-06-16T14:10:27.047Z","modified":"2026-06-17T13:49:28.484Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-37120","description":"Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.","status":"published","published":"2026-06-16T14:10:27Z","modified":"2026-06-17T13:49:28Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:38.883875Z"}],"nvd":[{"id":"CVE-2026-48780","description":"Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.","status":"published","published":"2026-06-16T15:16:41.64Z","modified":"2026-06-17T14:17:56.423Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:24.19758Z"}],"osv":[{"id":"CVE-2026-48780","title":"Forem vulnerable to bypass of email address domain restrictions","description":"Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.","status":"published","published":"2026-06-16T14:10:27.047Z","modified":"2026-10-28T02:30:22.740492937Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:45:06.701612Z"}]}}