{"id":"CVE-2026-61696","aliases":["EUVD-2026-61141","GHSA-4463-499m-94mx"],"status":"published","title":"Forem: Stored XSS in Admin Abuse Report Rendering","description":"Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.25549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-74","CWE-79"],"published":"2026-08-18T17:57:07Z","modified":"2026-10-28T02:30:55Z","products":[{"vendor":"forem","product":"forem"}],"references":[{"url":"https://github.com/forem/forem/security/advisories/GHSA-4463-499m-94mx","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/forem/forem/commit/92eacd16a82cf9007ba8e16a2258b42e3b53ca9c","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61696.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61696","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-61696","title":"Forem: Stored XSS in Admin Abuse Report Rendering","description":"Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c","status":"published","published":"2026-08-18T17:57:07.736Z","modified":"2026-08-18T18:15:34.952Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-74","CWE-79","CWE-116"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-61141","description":"Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c","status":"published","published":"2026-08-18T17:57:07Z","modified":"2026-08-18T18:15:34Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:46.405062Z"}],"nvd":[{"id":"CVE-2026-61696","description":"Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c","status":"published","published":"2026-08-18T18:18:52.497Z","modified":"2026-09-18T20:09:01.757Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-74","CWE-79","CWE-116"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"CVE-2026-61696","title":"Forem: Stored XSS in Admin Abuse Report Rendering","description":"Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c","status":"published","published":"2026-08-18T17:57:07.736Z","modified":"2026-10-28T02:30:55.241441069Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-116","CWE-74","CWE-79"],"updated_at":"2026-11-02T15:45:12.933503Z"}]}}