CVE-2019-13183

HIGH

Flarum < 0.1.0-beta.9 - Cross-Site Request Forgery

Title source: llm

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

Core 3

Core References

Release Notes, Third Party Advisory x_refsource_misc

Release Notes, Vendor Advisory x_refsource_confirm

Third Party Advisory x_refsource_confirm

CVSS v3 8.8

EPSS 0.0079

EPSS Percentile 52.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-352

Status published

Products (1)

flarum/flarum 0.1.0 (12 CPE variants)

Published Jul 07, 2019

Tracked Since Feb 18, 2026