CVE-2023-36466

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20 CWE-287

Affected software

Vendor	Product	Versions
discourse	discourse	stable < 3.0.5; beta < 3.1.0.beta6; tests-passed < 3.1.0.beta6

References

https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932Vendor Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932Vendor Advisory

Timeline

Published: Jul 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364678.8AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgra CVE-2023-364698.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own use CVE-2023-36474.8The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2023-364708.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing CVE-2023-364715.4Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6R CVE-2023-364725.7Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset pas CVE-2023-364736.1Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CVE-2023-364746.1Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 w CVE-2023-364759.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, a CVE-2023-364765.5calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensio CVE-2023-364775.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit