CVE-2023-38498

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.

• CWE-400
• CWE-770
• CWE-770

• https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2jVendor Advisory
• https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2jVendor Advisory

Published

Jul 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38492Kirby is a content management system. A vulnerability in ver…7.5
• CVE-2023-38493Armeria is a microservice framework Spring supports Matrix v…7.5
• CVE-2023-38494MeterSphere is an open-source continuous testing platform. P…7.5
• CVE-2023-38495Crossplane is a framework for building cloud native control …9.8
• CVE-2023-38496Apptainer is an open source container platform. Version 1.2.…3.3
• CVE-2023-38497Cargo downloads the Rust project’s dependencies and compiles…7.3
• CVE-2023-38499TYPO3 is an open source PHP based web content management sys…5.3
• CVE-2023-3850A vulnerability has been found in SourceCodester Lost and Fo…9.8
• CVE-2023-38500TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, a…6.1
• CVE-2023-38501copyparty is file server software. Prior to version 1.8.7, t…6.1
• CVE-2023-38502TDengine is an open source, time-series database optimized f…6.5
• CVE-2023-38503Directus is a real-time API and App dashboard for managing S…6.5