What’s Vulnerable › Vulnerabilities

CVE-2023-32687: Insufficiently Protected ChatBot Credentials in tgstation-server

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-29 · updated 2026-06-17
• Weakness: CWE-522

Description

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

Affected products

• tgstation-server: from 4.7.0 before 5.12.1 — fixed in 5.12.1

How to fix

Upgrade to a fixed version: tgstation-server 5.12.1. Check the vendor advisory for mitigations.

References

• https://github.com/tgstation/tgstation-server/pull/1487
• https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp
• https://github.com/tgstation/tgstation-server/pull/1487
• https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp

Get alerted when CVE-2023-32687 or the next vulnerability affects your stack