The flaw permits a forum member to craft a nickname that is interpreted as a hyperlink by common email clients. When the flarum/nicknames extension is active, that nickname is inserted unchanged into plain‑text notification emails. This allows an attacker to lure recipients into clicking a link that points to an attacker-controlled domain, leading to potential phishing or drive‑by compromise. The weakness corresponds to OWASP CWE‑79, reflected in the CVE’s descriptive CWE list.

The vulnerability exists in the flarum/nicknames extension for the Flarum forum platform. All versions released before the fix (e.g., prior to v1.8) are affected. The advisory references the GitHub commit that introduced the patch and the release tag v1.8 where the issue is resolved.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of real‑world exploitation at the time of analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local to the extension: an attacker sets a malicious nickname that propagates through email notifications to domain‑connected recipients. No privileged system access or network exploitation is required; the risk hinges on recipient interaction with the embedded link.