A potential security issue has been identified that may allow gaining access to Lemmings Forums accounts via abusing links in poll options in a certian manner. Links in posts or PMs are not at risk. This is an issue in SMF itself and is not specific to Lemmings Forums. Passwords cannot be accessed via the exploit in question, but non-public profile information could be.
We are not aware of anyone actually exploiting this to gain access to accounts, nor attempting to do so. The recently-posted (and now removed) poll that looked suspicious was constructed in a way that the user posting it could confirm this issue existed, without being able to actually exploit it themself to access anyone else's account; this user then immediately reported the situation to a site admin once they confirmed the exploit was viable.
I have reached out to SMF - this issue has apparently been reported to them, but there is no public record of it being reported and/or fixed. This being said, SMF have a seperate, private report form for security issues, so it is quite possible they are choosing to keep it internal until they release an update with a fix. I am hoping they can confirm when to expect a fix, and if it's going to be a while (or I don't get a response within a day or two), I'll look into making a bespoke fix for it.
I have now applied a temporary measure that should prevent the exploit in question. Caution is still advised until a proper fix is confirmed to be in place.