CVE-2026-39924 Details
Description
Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.
A vulnerability exists in Flarum versions prior to 1.8.16, where improper session invalidation allows attackers with a valid session token to maintain full access to an account after the password has been changed. This issue arises because the access_tokens table is not cleared during password change events. The TokensClearer::clearPasswordTokens() function only deletes entries from the password_tokens table, leaving all active session cookies and API bearer tokens, including long-lived RememberAccessToken tokens, untouched. Consequently, sessions held by attackers remain active even after a password reset, including those reset by administrators via the user update endpoint.
Users can update to Flarum version 1.8.17 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flarum/framework/commit/5f080293a029d0d273eb9678d597c74ea86a3bcc | [email protected] | Source CodeVendor |
| https://github.com/flarum/framework/pull/4546 | [email protected] | Issue TrackingVendor |
| https://github.com/flarum/framework/releases/tag/v1.8.16 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/flarum-session-persistence-via-improper-access-token-revocation | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flarum | < 1.8.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | New CVE Received | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |