-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete cleanup of email tokens during confirmation. The commit diff shows the fix changed from deleting a single token ($token->delete()) to deleting all user email tokens ($user->emailTokens()->delete()). The original implementation in ConfirmEmailHandler.php only removed the specific confirmation token, leaving other potentially valid tokens intact. This matches the CWE-459 (Incomplete Cleanup) description and the vulnerability's nature of improper token invalidation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flarum/flarum | composer | < 0.1.0-beta.8 | 0.1.0-beta.8 |
Ongoing coverage of React2Shell