vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-22453

Discourse vulnerable to exposure of user post counts per topic to unauthorized users

MEDIUM
5.3
CVSS Score
Published: January 5, 2023 at 07:53 PM UTC
Updated: June 17, 2026 at 05:35 AM UTC
1 product affected across 1 vendorDiscourse

Using discourse by discourse?

Get instant alerts when new vulnerabilities affect discourse - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.6%
SSVC
No known exploit

Description

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Discourse· Discourse
95%
v < 2.8.14v < 3.0.0.beta161.1.0 beta11.1.0 beta21.1.0 beta31.1.0 beta41.1.0 beta51.1.0 beta61.1.0 beta6b1.1.0 beta71.1.0 beta81.2.0 beta11.2.0 beta21.2.0 beta31.2.0 beta41.2.0 beta51.2.0 beta61.2.0 beta71.2.0 beta81.2.0 beta91.3.0 beta11.3.0 beta101.3.0 beta111.3.0 beta21.3.0 beta31.3.0 beta41.3.0 beta51.3.0 beta61.3.0 beta71.3.0 beta81.3.0 beta91.4.0 beta11.4.0 beta101.4.0 beta111.4.0 beta121.4.0 beta21.4.0 beta31.4.0 beta41.4.0 beta51.4.0 beta61.4.0 beta71.4.0 beta81.4.0 beta91.5.0 beta11.5.0 beta101.5.0 beta111.5.0 beta121.5.0 beta131.5.0 beta13b1.5.0 beta141.5.0 beta21.5.0 beta31.5.0 beta41.5.0 beta51.5.0 beta61.5.0 beta71.5.0 beta81.5.0 beta91.6.0 beta11.6.0 beta101.6.0 beta111.6.0 beta121.6.0 beta21.6.0 beta31.6.0 beta41.6.0 beta51.6.0 beta61.6.0 beta71.6.0 beta81.6.0 beta91.7.0 beta11.7.0 beta101.7.0 beta111.7.0 beta21.7.0 beta31.7.0 beta41.7.0 beta51.7.0 beta61.7.0 beta71.7.0 beta81.7.0 beta91.8.0 beta11.8.0 beta101.8.0 beta111.8.0 beta121.8.0 beta131.8.0 beta21.8.0 beta31.8.0 beta41.8.0 beta51.8.0 beta61.8.0 beta71.8.0 beta81.8.0 beta91.9.0 beta11.9.0 beta101.9.0 beta111.9.0 beta121.9.0 beta131.9.0 beta141.9.0 beta151.9.0 beta161.9.0 beta171.9.0 beta21.9.0 beta31.9.0 beta41.9.0 beta51.9.0 beta61.9.0 beta71.9.0 beta81.9.0 beta92.0.0 beta12.0.0 beta102.0.0 beta22.0.0 beta32.0.0 beta42.0.0 beta52.0.0 beta62.0.0 beta72.0.0 beta82.0.0 beta92.1.0 beta12.1.0 beta22.1.0 beta32.1.0 beta42.1.0 beta52.1.0 beta62.2.0 beta12.2.0 beta102.2.0 beta22.2.0 beta32.2.0 beta42.2.0 beta52.2.0 beta62.2.0 beta72.2.0 beta82.2.0 beta92.3.0 beta12.3.0 beta102.3.0 beta112.3.0 beta22.3.0 beta32.3.0 beta42.3.0 beta52.3.0 beta62.3.0 beta72.3.0 beta82.3.0 beta92.4.0 beta12.4.0 beta102.4.0 beta112.4.0 beta22.4.0 beta32.4.0 beta42.4.0 beta52.4.0 beta62.4.0 beta72.4.0 beta82.4.0 beta92.5.0 beta12.5.0 beta22.5.0 beta32.5.0 beta42.5.0 beta52.5.0 beta62.5.0 beta72.6.0 beta12.6.0 beta22.6.0 beta32.6.0 beta42.6.0 beta52.6.0 beta62.7.0 beta12.7.0 beta22.7.0 beta32.7.0 beta42.7.0 beta52.7.0 beta62.7.0 beta72.7.0 beta82.7.0 beta92.8.0 beta12.8.0 beta102.8.0 beta112.8.0 beta22.8.0 beta32.8.0 beta42.8.0 beta52.8.0 beta62.8.0 beta72.8.0 beta82.8.0 beta92.9.0 beta12.9.0 beta102.9.0 beta112.9.0 beta122.9.0 beta132.9.0 beta142.9.0 beta22.9.0 beta32.9.0 beta42.9.0 beta52.9.0 beta62.9.0 beta72.9.0 beta82.9.0 beta93.0.0 beta15
Affected range stops below 2.8.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.0.0.beta16, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-200

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card