CVE-2007-2249: include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain priv...

Security readout for executives and security teams

Older Phorum forum installations before 5.1.22 allowed a logged-in moderator to manipulate user-management input and gain higher privileges. This is not an unauthenticated internet-wide issue, but it matters where moderator accounts are shared, weakly protected, or assigned to external parties. Exposure is mainly legacy Phorum deployments running versions earlier than 5.1.22, especially forums with active moderator accounts. Systems without Phorum, on 5.1.22 or later, or without untrusted moderator access are less likely to be exposed. Prioritize if the organization still runs Phorum or inherited legacy forum infrastructure. The issue is old and requires moderator access, but successful abuse could turn a limited forum role into broader administrative control. Mitigation focus: Upgrade Phorum installations before 5.1.22 to 5.1.22 or later.; Check Phorum vendor guidance and advisory notes before making production changes.; Restrict moderator accounts to trusted users only..

Prepared

Jun 29, 2026, 05:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.