Vulnerability · Published Aug 5, 2026 · Assigned by VulnCheck

CVE-2026-39924Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Medium 6.8

In plain English

A medium-severity security flaw in Flarum Framework from Flarum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 68.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

Affected products (as reported)

Vendor	Product	Versions
Flarum	Flarum Framework	0 – before 1.8.16

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/flarum-session-persistence-via-improper-access-token-revocation third-party-advisory