{"id":"CVE-2026-87901","kind":"vulnerability","aliases":["CVE-2026-87901"],"related":[],"title":"Registration module lets reflected script injection run in victims' browsers","description":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.","summary":"The registration module does not sanitize input, so a crafted link can make it reflect script back to the visitor. An attacker who gets a victim to open that link can run script in the victim's browser session.","severity":"high","cvss":8.3,"epss":0.00393,"exploited":false,"exploited_at":null,"products":[{"name":"phpBB","fixed":["3.3.19"],"affected":">= 3.3.0, <= 3.3.18","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["forum","other","php","phpbb","self-hosted","web-app","xss"],"not_affected_if":["phpbb-3.3.19"],"how_to_check":"Check your phpBB version in the Admin Control Panel (ACP index shows the installed version) or in includes/constants.php (PHPBB_VERSION). Any 3.3.0 through 3.3.18 is exposed; 3.3.19 is fixed.","fix":"Update phpBB to 3.3.19 (released 2026-09-24). 3.3.18 packages did not contain the fix; do not stop at 3.3.18.","status":"open","published_at":"2026-10-23T17:17:22+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:01:59+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:01:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Registration module lets reflected script injection run in victims' browsers","impact":"medium","summary":"The registration module does not sanitize input, so a crafted link can make it reflect script back to the visitor. An attacker who gets a victim to open that link can run script in the victim's browser session.","category":"other","nicknames":[],"who_cares":["web-app"],"confidence":0.4,"needs_auth":"no","worst_case":"script runs in victim's browser session, session data exposed","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87901, since the sources name no product.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000483,"input_tokens":3234,"output_tokens":320,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87901, since the sources name no product.","search":"'-2026':12A,15A '-87901':13A,16A 'allow':74C 'app':27B 'attack':50B 'back':45B 'browser':10A,66B 'craft':38B 'cross':77C 'cross-sit':76C 'cve':11A,14A 'forum':18B 'get':52B 'host':24B 'improp':68C 'inject':6A 'input':35B 'let':3A 'link':39B,58B 'make':41B 'modul':2A,31B,73C 'open':56B 'php':20B 'phpbb':17A,21B 'reflect':4A,43B,75C 'registr':1A,30B,72C 'run':7A,60B 'sanit':34B,69C 'script':5A,44B,61B,79C 'self':23B 'self-host':22B 'session':67B 'site':78C 'victim':9A,54B,64B 'visitor':48B 'web':26B 'web-app':25B 'xss':28B","nicknames":[],"mitigations":[],"who_affected":"Any phpBB forum running 3.3.0 through 3.3.18 with the registration page reachable. An attacker sends a crafted link to a registration page and the script runs in the visitor's browser, which is most dangerous for admins and moderators who are logged in. Forums already on 3.3.19 can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:15:11Z","by":"analyst","run_id":678},"products":{"at":"2026-10-25T03:15:11Z","by":"analyst","run_id":678}},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87901","severity":null,"published_at":"2026-10-23T17:17:22+00:00","modified_at":"2026-10-23T17:17:22+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87901:678","url":null,"severity":null,"published_at":"2026-10-25T03:15:11+00:00","modified_at":"2026-10-25T03:15:11+00:00","first_seen_at":"2026-10-25T03:15:11+00:00","fetched_at":"2026-10-25T03:15:11+00:00","note":"Product is phpBB (NVD affected data + phpBB 3.3.18/3.3.19 announcements, SECURITY-301). 3.3.18 shipped without the fixes (packaging error), so 3.3.19 is the real fix. No exploitation or PoC found."},{"source":"epss","external_id":"CVE-2026-87901","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87901","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":3084,"url":"https://www.phpbb.com/community/viewtopic.php?t=2675305","title":"phpBB 3.3.19 Release - Urgent update","kind":"vendor","source":"analyst","text":"phpBB 3.3.18 downloads did not include the announced security fixes due to a packaging mistake. 3.3.19 (24 Sep 2026) contains them; update directly to 3.3.19.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3085,"url":"https://www.phpbb.com/community/viewtopic.php?t=2675239","title":"phpBB 3.3.18 Release - Urgent update","kind":"vendor","source":"analyst","text":"phpBB 3.3.18 announcement: urgent update fixing reflected XSS CVE-2026-87901, reported by Aikido Security. Note: 3.3.18 packages lacked the fixes; see 3.3.19.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}