CVE-2026-48780: Forem vulnerable to bypass of email address domain restrictions

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-16 · updated 2026-06-17
Weakness: CWE-287

Description

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.

Affected products

forem: before a2ab6d4

References

https://github.com/forem/forem/commit/a2ab6d409d2676eb0711ecbd737192043125b437
https://github.com/forem/forem/security/advisories/GHSA-3g4h-9h37-mpx6

Get alerted when CVE-2026-48780 or the next vulnerability affects your stack