Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2023-30611

Reaction metadata exposed in private topics in Discourse-reactions

Description

Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse-reactions

  • >= 0.2, < 0.3affected

References