CVE-2026-30913: Flarum Nicknames

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

Affected products

• Flarum Nicknames: before 1.8.3 (fixed in 1.8.3)

Published 2026-03-10. Last modified 2026-06-17.