CVE-2023-25169

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit `b3ab33bbf7` which is included in the latest version of the Discourse Yearly Review plugin. Users are advised to upgrade. Users unable to upgrade may disable the `yearly_review_enabled` setting to fully mitigate the issue. Also, it's possible to edit the anonymised user's old data in the yearly review topics manually.

• CWE-200

• https://github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3cPatch
• https://github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7Mitigation, Vendor Advisory
• https://github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3cPatch
• https://github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7Mitigation, Vendor Advisory

Published

Mar 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25163Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2023-25164Tinacms is a Git-backed headless content management system w…7.5
• CVE-2023-25165Helm is a tool that streamlines installing and managing Kube…4.3
• CVE-2023-25166formula is a math and string formula parser. In versions pri…6.5
• CVE-2023-25167Discourse is an open source discussion platform. In affected…5.7
• CVE-2023-25168Wings is Pterodactyl's server control plane. This vulnerabil…8.2
• CVE-2023-2517The Metform Elementor Contact Form Builder plugin for WordPr…4.3
• CVE-2023-25170PrestaShop is an open source e-commerce web application that…8.8
• CVE-2023-25171Kiwi TCMS, an open source test management system, does not i…5.9
• CVE-2023-25172Discourse is an open-source discussion platform. Prior to ve…5.4
• CVE-2023-25173containerd is an open source container runtime. A bug was fo…7.8
• CVE-2023-25174Improper access control in some Intel(R) Chipset Driver Soft…7.8