What’s Vulnerable › Vulnerabilities

CVE-2023-25169: Yearly Review Plugin leaking anonymised users data in discourse-yearly-review

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-06 · updated 2026-06-17
• Weakness: CWE-200

Description

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit `b3ab33bbf7` which is included in the latest version of the Discourse Yearly Review plugin. Users are advised to upgrade. Users unable to upgrade may disable the `yearly_review_enabled` setting to fully mitigate the issue. Also, it's possible to edit the anonymised user's old data in the yearly review topics manually.

Affected products

• discourse-yearly-review: before 0.2 — fixed in 0.2

How to fix

Upgrade to a fixed version: discourse-yearly-review 0.2. Check the vendor advisory for mitigations.

References

• https://github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3c
• https://github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7
• https://github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3c
• https://github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7

Get alerted when CVE-2023-25169 or the next vulnerability affects your stack