Security issue all versions <=3.4.0

#1 · October 9, 2026, 3:22 pm

Hi dear support team,

Patchstack published a security lack today without a fixed version of your plugin. Are you aware of it? Can you please tell me if and when you’ll deliver a fixed version?
Thanks a lot for quick answer.

best regards
Thomas

gefitz has reacted to this post.

#2 · October 13, 2026, 5:38 pm

CVE Record: CVE-2026-39779

An update for this must be coming, correct?

Thanks for letting us know!

#3 · October 19, 2026, 5:51 pm

CleanTalk Security is also reporting the vulnerability: CVE-2026-39779,

When can we expect a patch please?

gefitz has reacted to this post.

#4 · October 24, 2026, 10:32 am

The issue has been partially fixed with v3.5.0 – however, further hardening is required. I also want to emphasize, that the risk is kind of low since it “only” allows users under some circumstances to subscribe to forums/topics which they cannot access under normal conditions.

If you want to support the development of Asgaros Forum, you can leave a good review or donate. Thank you very much!