---
id: CVE-2026-61696
title: Forem is open source software for building communities
summary: >-
  Forem is open source software for building communities. In versions before
  commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted
  through feedback_message[message] is stored without sanitization and rendered
  in app/…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-74
  - CWE-79
  - CWE-116
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61696'
references:
  - url: >-
      https://github.com/forem/forem/commit/92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
    label: security-advisories@github.com
  - url: 'https://github.com/forem/forem/security/advisories/GHSA-4463-499m-94mx'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00322
epssPercentile: 0.22488
ingestedAt: '2026-09-18T20:51:25.635Z'
---

## Overview

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.