CVE-2026-48780

Name of the Vulnerable Software and Affected Versions Forem versions prior to commit a2ab6d4

Description An issue exists where a maliciously crafted email address can be used to bypass domain allowlist or denylist restrictions. This allows an attacker to gain unauthorized access to invite-only deployments.

Recommendations Update to the version containing commit a2ab6d4. As a temporary workaround, use SMTP servers or email delivery providers that drop or refuse to send maliciously crafted email addresses.