CVE-2023-49099

MEDIUM4.3EPSS 0.29%

Discourse secure uploads accessible to guests even when login is required

Published: 3/6/2024Modified: 10/15/2025

Also known as:GHSA-j67x-x6mq-pwv4BIT-discourse-2023-49099

Description

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.

Affected packages (1)

Bitnami/discoursefrom 0, < 3.1.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References (3)

WEBhttps://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53
WEBhttps://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2023-49099