CVE-2019-13183: Flarum

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

Affected products

• Flarum Flarum: version 0.1.0 only

Published 2019-07-07. Last modified 2026-06-17.