Flarum Flarum Framework

• CVE-2026-39924 Medium 6.8 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation 0.4%
• CVE-2026-39923 High 8.1 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset 0.4%