CVE-2023-49099

Discourse secure uploads accessible to guests even when login is required

State: Published
Severity: 3.1 Low
Published: Jan 12, 2024
Updated: Jun 17, 2025
Reserved: Nov 21, 2023

Description

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
discoursediscourse	< 3.1.4Affected >= 3.2.0beta1, < 3.2.0.beta4Affected

References

https://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4
https://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.