Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-45131

Unauthenticated access to new private chat messages in Discourse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • stable < 3.1.2affected
  • beta < 3.2.0.beta2affected

References