CVE-2023-22453

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.

• CWE-200

• https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2adPatch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rvThird Party Advisory
• https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2adPatch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rvThird Party Advisory

Published

Jan 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22448Improper access control for some Intel Unison software may a…7.2
• CVE-2023-22449Improper input validation in some Intel(R) NUC BIOS firmware…6.7
• CVE-2023-2245A vulnerability was found in hansunCMS 1.4.3. It has been de…6.3
• CVE-2023-22450 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an…7.2
• CVE-2023-22451Kiwi TCMS is an open source test management system. In versi…8.8
• CVE-2023-22452kenny2automate is a Discord bot. In the web interface for se…6.5
• CVE-2023-22454Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22455Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22456ViewVC, a browser interface for CVS and Subversion version c…6.1
• CVE-2023-22457CKEditor Integration UI adds support for editing wiki pages …8.8
• CVE-2023-22458Redis is an in-memory database that persists on disk. Authen…5.5
• CVE-2023-2246A vulnerability has been found in SourceCodester Online Pizz…9.8