Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-30913 Flarum Nickname Extension Email Injection Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30913
Post summary
The snippet references CVE‑2026‑30913, noting an Email Injection vulnerability in the Flarum Nickname Extension, but provides minimal detail and no evidence of exploitation, patches, or proof of concept.
CVE-2026-30913 Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpre… https://www.cve.org/CVERecord?id=CVE-2026-30913
Post summary
This CVE concerns a flaw in Flarum’s nicknames extension that allows a registered user to set a nickname string interpreted by email clients, potentially leading to exploitation. No PoC, exploit, patch, or evidence of active exploitation is reported.
🚨*CVE* CVE-2026-30913 Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpre… https://www.cve.org/CVERecord?id=CVE-2026-30913 ----- Traducción: CVE-2026-30913 Fla… http://infoflow.cloud`
Post summary
The post cites CVE-2026-30913, noting that enabling the flarum/nicknames extension allows a registered user to set a nickname that can be interpreted by email clients, but it provides no PoC, exploitation details, patch, or technical specifics.
🟠 #Flarum, Input Validation Vulnerability, #CVE-2026-30913 (Medium) https://dailycve.com/flarum-input-validation-vulnerability-cve-2026-30913-medium/
Post summary
The post simply cites CVE-2026-30913 with a reference link, offering no additional evidence of PoC, exploit, active use, or mitigation.