CVE-2023-45816 json
Unread bookmark reminder notifications that the user cannot access can be seen
published 2023-11-10 2 y ago modified 2026-09-08 2 mo ago also BIT-discourse-2023-45816 , EUVD-2023-50095 , GHSA-v9r6-92wp-f6cf
- cvss
- 3.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer access the underlying resource. As of version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, bookmark reminders are now no longer sent if the user does not have access to the underlying bookmarkable, and also the unread bookmark notifications are always filtered by access. There are no known workarounds.
Patch / fix
- bitnami discourse 3.2.0
- discourse discourse 3.1.3, 3.2.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <3.2.0 |
3.2.0 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/discourse/discourse/commit/2c45b949ea0e9d6fa8e5af2dd07f6521ede08bf1
patch
-
github.com
/discourse/discourse/commit/3c5fb871c0f54af47679ae71ad449666b01d8216
patch
-
github.com
/discourse/discourse/security/advisories/GHSA-v9r6-92wp-f6cf
vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-45816
web
Sources
- CVE List CVE-2023-45816
- NVD CVE-2023-45816
- OSV BIT-discourse-2023-45816
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.