The phpBB Team reports:
- Resend rate limiting incorrectly updating expiration time
(SECURITY-298)
- Attachment comment hijacking by other users
(SECURITY-300)
- Reflected XSS via data passed to registration page
(SECURITY-301, CVE-2026-87901)
- Hide oauth provider secrets in ACP (SECURITY-302)
- Potential stored XSS for string profile fields when allowing
any character (SECURITY-303)
- Missing permission type check when applying role based
permissions (SECURITY-305)
- Disclosure of hidden or unapproved topic title when emailing
topic (SECURITY-306)
- Banned users can email members despite ban status
(SECURITY-307)
- Releasing of held private messages missing CSRF protection
(SECURITY-308)
- Missing encoding of username in anti abuse header
(SECURITY-309)
- MCP topic view mixing access checks for post and topic
(SECURITY-310)
- Moderators with f_user_lock permission may close other user's
topics (SECURITY-311)
- Unauthenticated SMTP command injection via contact form
(SECURITY-312)
- Moderators can close/delete reports outside their forum
permissions (SECURITY-313)
- MCP make normal action for topics missing check for
forum-scoped moderators (SECURITY-314)
The fixes were announced with phpBB 3.3.18, but the 3.3.18
downloads did not contain them, so only 3.3.19 ships the fixed
code.