CVE-2023-23615: Malicious users in Discourse can create spam topics as any user due to improper access control

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-03 · updated 2026-06-17
Weakness: CWE-284

Description

Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.

Affected products

discourse: through 3.0.0; 1.1.0-beta1, 1.1.0-beta2, 1.1.0-beta3, 1.1.0-beta4, 1.1.0-beta5, 1.1.0-beta6 (+201)

References

https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8
https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8

Get alerted when CVE-2023-23615 or the next vulnerability affects your stack