A flaw in the login function of PhpBB phbb3 v3.3.15 allows a local attacker to send a crafted web request that is treated as a legitimate login attempt. Because the application does not validate a CSRF token or properly authenticate the request, the attacker can trigger the execution of arbitrary code on the host that runs the forum software. This is a classic cross‑site request forgery weakness combined with an ability to execute code on the server, placing the application and underlying system at significant risk.

The vulnerability impacts only installations of PhpBB phbb3 at version 3.3.15. No other product variants or vendor versions were identified. Any instance running this exact release without applying a fix is considered vulnerable.

The vulnerability requires that the attacker already have local access to the machine running the forum. A remote attacker would first need to gain local user privileges or compromise a process that can issue HTTP requests to the login page. No public exploits have been observed and the issue is not listed in any known exploited vulnerability catalog, which suggests a limited current threat surface. Nonetheless, the consequences—complete compromise of the host—make mitigation a top priority whenever local access is possible.