CVE-2026-30913 — flarum/nickname: Display name injection in notification emails (autolink & markdown)
Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hype…
Published: 2026-03-09 · CVSS: 4.6 · CVSS 3.1
Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7