CVE-2023-49099: Discourse secure uploads accessible to guests even when login is required

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-12 · updated 2026-06-17
Weakness: CWE-284

Description

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.

Affected products

discourse: before 3.1.4; 3.2.0-beta1, 3.2.0-beta2, 3.2.0-beta3 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: discourse 3.1.4. Check the vendor advisory for mitigations.

References

https://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53
https://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4
https://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53
https://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4

Get alerted when CVE-2023-49099 or the next vulnerability affects your stack