CVE-2023-32687

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

• CWE-522
• CWE-522

• https://github.com/tgstation/tgstation-server/pull/1487Patch
• https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1Release Notes
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cpVendor Advisory
• https://github.com/tgstation/tgstation-server/pull/1487Patch
• https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1Release Notes
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cpVendor Advisory

Published

May 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32681Requests is a HTTP library. Since Requests 2.3.0, Requests h…6.1
• CVE-2023-32682Synapse is a Matrix protocol homeserver written in Python wi…5.4
• CVE-2023-32683Synapse is a Matrix protocol homeserver written in Python wi…5.4
• CVE-2023-32684Lima launches Linux virtual machines, typically on macOS, fo…2.5
• CVE-2023-32685Kanboard is project management software that focuses on the …5.4
• CVE-2023-32686Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-32688parse-server-push-adapter is the official Push Notification …7.5
• CVE-2023-32689Parse Server is an open source backend that can be deployed …6.5
• CVE-2023-3269A vulnerability exists in the memory management subsystem of…7.8
• CVE-2023-32690libspdm is a sample implementation that follows the DMTF SPD…7.5
• CVE-2023-32691gost (GO Simple Tunnel) is a simple tunnel written in golang…5.9
• CVE-2023-32692CodeIgniter is a PHP full-stack web framework. This vulnerab…9.8