{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30913", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.883Z", "datePublished": "2026-03-09T22:42:40.014Z", "dateUpdated": "2026-03-10T14:17:30.046Z"}, "containers": {"cna": {"title": "flarum/nickname: Display name injection in notification emails (autolink & markdown)", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25"}, {"name": "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28", "tags": ["x_refsource_MISC"], "url": "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28"}, {"name": "https://github.com/flarum/nicknames/releases/tag/v1.8.", "tags": ["x_refsource_MISC"], "url": "https://github.com/flarum/nicknames/releases/tag/v1.8."}], "affected": [{"vendor": "flarum", "product": "nicknames", "versions": [{"version": "< 1.8.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:42:40.014Z"}, "descriptions": [{"lang": "en", "value": "Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains."}], "source": {"advisory": "GHSA-3c4m-j3g4-hh25", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:17:25.125303Z", "id": "CVE-2026-30913", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:17:30.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30913", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:17:25.125303Z"}}}], "references": [{"url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:17:20.336Z"}}], "cna": {"title": "flarum/nickname: Display name injection in notification emails (autolink & markdown)", "source": {"advisory": "GHSA-3c4m-j3g4-hh25", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "flarum", "product": "nicknames", "versions": [{"status": "affected", "version": "< 1.8.3"}]}], "references": [{"url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25", "name": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28", "name": "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/flarum/nicknames/releases/tag/v1.8.", "name": "https://github.com/flarum/nicknames/releases/tag/v1.8.", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:42:40.014Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30913", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:17:30.046Z", "dateReserved": "2026-03-07T16:40:05.883Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T22:42:40.014Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains."}, {"lang": "es", "value": "Flarum es un software de foro de c\u00f3digo abierto. Cuando la extensi\u00f3n flarum/nicknames est\u00e1 habilitada, un usuario registrado puede establecer su apodo a una cadena que los clientes de correo electr\u00f3nico interpretan como un hiperv\u00ednculo. El apodo se inserta textualmente en los correos electr\u00f3nicos de notificaci\u00f3n de texto sin formato, y los destinatarios pueden ser enga\u00f1ados para que visiten dominios controlados por el atacante."}], "id": "CVE-2026-30913", "lastModified": "2026-04-29T20:49:53.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-10T17:40:15.210", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25"}, {"source": "security-advisories@github.com", "url": "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28"}, {"source": "security-advisories@github.com", "url": "https://github.com/flarum/nicknames/releases/tag/v1.8."}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nicknames", "source": "cna", "vendor": "flarum"}, "product": "nicknames", "vendor": "flarum"}], "analysis": {"en": {"generated_at": "2026-04-16T10:02:07.478532+00:00", "value": {"mitigation_remediation": ["Update the flarum/nicknames extension to v1.8 or newer", "Disable nickname display in notification emails if an update is not yet possible", "Consider disabling or limiting user\u2011controlled nicknames until the extension can be upgraded"], "summary": {"action": "Patch Extension", "impact": "Phishing via injected hyperlinks in email notifications"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the flarum/nicknames extension for the Flarum forum platform. All versions released before the fix (e.g., prior to v1.8) are affected. The advisory references the GitHub commit that introduced the patch and the release tag v1.8 where the issue is resolved.", "description_and_impact": "The flaw permits a forum member to craft a nickname that is interpreted as a hyperlink by common email clients. When the flarum/nicknames extension is active, that nickname is inserted unchanged into plain\u2011text notification emails. This allows an attacker to lure recipients into clicking a link that points to an attacker-controlled domain, leading to potential phishing or drive\u2011by compromise. The weakness corresponds to OWASP CWE\u201179, reflected in the CVE\u2019s descriptive CWE list.", "risk_and_exploitability": "The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of real\u2011world exploitation at the time of analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local to the extension: an attacker sets a malicious nickname that propagates through email notifications to domain\u2011connected recipients. No privileged system access or network exploitation is required; the risk hinges on recipient interaction with the embedded link."}}}}, "created": "2026-03-10T14:06:28.893953+00:00", "updated": "2026-04-16T10:15:26.101414+00:00", "vendors": ["flarum", "flarum$PRODUCT$nicknames"]}