Cross-Site Scripting Vulnerability in Forem by Forem

CVE-2026-61696

What is CVE-2026-61696?

Forem is an open-source platform designed for building online communities. Prior to a specific commit, an XSS vulnerability existed where unsanitized input was accepted through the feedback mechanism. When an administrator viewed certain reports, malicious scripts could execute in their browser, potentially revealing sensitive information or allowing unauthorized actions. This significant security flaw was exploitable by unauthenticated attackers due to insufficient access controls in the FeedbackMessagesController. The issue has been addressed in a subsequent commit.

References