CVE-2026-61696: Forem: Stored XSS in Admin Abuse Report Rendering
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessage[message] is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through raw(feedbackmessage.message) when offenderid is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offenderid, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foremto a version that resolves this vulnerability.Patch 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
Event History
Frequently Asked Questions
Who can exploit this issue, and who is affected?
Any Forem deployment using code before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c is exposed if an administrator views a crafted abuse report. The reporting endpoint was public, so an attacker did not need an authenticated account to submit the report.
What conditions are required for exploitation?
The attacker must submit a malicious feedback_message[message] value and cause it to be stored with an offender_id so that it reaches the administrator abuse-report rendering path. Exploitation then requires an administrator to view the report; the JavaScript executes in that administrator's browser session.
What remediation is available?
Update to the fix in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c. The provided information does not describe an alternative mitigation for deployments that cannot apply the fix immediately.
How can I assess whether the issue may already have been exploited?
Review stored feedback or abuse reports for attacker-controlled content in feedback_message[message], particularly reports with an offender_id, and treat suspicious markup or script-like content as potentially dangerous. Administrators should avoid opening suspicious reports in an affected deployment because rendering them can execute arbitrary JavaScript.