CVE-2024-21641

    Dashboard / Vulnerabilities / CVE-2024-21641

    CVE-2024-21641

    Published: 5 Jan 2024Last Modified: 28 Oct 2026

    Summary: Flarum's Logout Route allows open redirects

    Details: Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21641.json, https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr, https://nvd.nist.gov/vuln/detail/CVE-2024-21641, https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a, https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2e8500500c58927ab056ec2d27ec36ea836cf1b2

    Affected versions

    v1.8.4
    v1.8.3
    v1.8.2
    v1.8.1
    v1.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-21641 | CVE-DB