Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2023-38685

Discourse's restricted tag information visible to unauthenticated users

Description

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • >= 3.1.0.beta1, < 3.1.0.beta7affected
  • < 3.0.6affected

References