CVE-2026-91831: Subscribe to Comments 2.3 to before 2.3.3

Affected technology

Subscribe to Comments · 2.3 to before 2.3.3
Vendor not specified by the source

Description’s affected range: before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 3.8/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.