CVE-2023-36466

LOW

Discourse < 3.0.5 - Improper Authentication via Topic Title Validation Bypass

Title source: llm
STIX 2.1

Description

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

References (1)

Core 1
Core References

Scores

CVSS v3 3.5
EPSS 0.0005
EPSS Percentile 16.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-287 CWE-20
Status published
Products (5)
discourse/discourse 1.1.0 beta1 (9 CPE variants)
discourse/discourse 1.2.0 beta1 (9 CPE variants)
discourse/discourse 1.3.0 beta1 (11 CPE variants)
discourse/discourse 1.4.0 beta1 (12 CPE variants)
discourse/discourse 1.5.0 beta1 (9 CPE variants)
Published Jul 14, 2023
Tracked Since Feb 18, 2026