CVE-2026-61696
Received Received - Intake

Stored XSS in Forem via Unsanitized Feedback Message

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-61696
EUVD
EUVD-2026-61141

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forem forem to 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Forem platform. A malicious user can submit a crafted feedback message with unsanitized input through the feedback_message[message] parameter. When an offender_id is present, this input is stored and later rendered in the admin abuse report interface without proper escaping, executing arbitrary JavaScript in an administrator's browser.

Detection Guidance

Check Forem application logs for suspicious feedback submissions containing HTML or JavaScript payloads in the feedback_message[message] parameter. Inspect admin abuse reports for rendered raw output that includes unexpected scripts. Review network traffic for POST requests to /feedback_messages with offender_id parameters in older versions.

Impact Analysis

An attacker could steal sensitive data like CSRF tokens or in-page information, perform unauthorized administrative actions on behalf of the victim, or compromise the administrator's session. This requires the attacker to trick an admin into viewing the malicious report.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches or unauthorized disclosures.

Mitigation Strategies

Update Forem to the latest commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c or newer. Remove offender_id parameter handling from FeedbackMessagesController. Ensure feedback messages are properly escaped in admin views. Monitor for unauthorized admin actions or data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart