CVE-2023-45806

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.

• CWE-1333

• https://github.com/discourse/discourse/commit/2ec25105179199cf80912bf011c18b8b870e1863Patch
• https://github.com/discourse/discourse/commit/7d484864fe91ff79c478f57e7ddb1235d701921ePatch
• https://github.com/discourse/discourse/security/advisories/GHSA-hcgf-hg2g-mw78Patch, Vendor Advisory
• https://github.com/discourse/discourse/commit/2ec25105179199cf80912bf011c18b8b870e1863Patch
• https://github.com/discourse/discourse/commit/7d484864fe91ff79c478f57e7ddb1235d701921ePatch
• https://github.com/discourse/discourse/security/advisories/GHSA-hcgf-hg2g-mw78Patch, Vendor Advisory

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45800Improper Neutralization of Special Elements used in an SQL C…7.5
• CVE-2023-45801Improper Authentication vulnerability in Nadatel DVR allows …7.5
• CVE-2023-45802When a HTTP/2 stream was reset (RST frame) by a client, ther…5.9
• CVE-2023-45803urllib3 is a user-friendly HTTP client library for Python. u…4.2
• CVE-2023-45804Rejected reason: User requested a CVE number by mistake
• CVE-2023-45805pdm is a Python package and dependency manager supporting th…7.8
• CVE-2023-45807OpenSearch is a community-driven, open source fork of Elasti…5.4
• CVE-2023-45808iTop is an IT service management platform. When creating or…5.4
• CVE-2023-45809Wagtail is an open source content management system built on…2.7
• CVE-2023-4581Excel `.xll` add-in files did not have a blocklist entry in …4.3
• CVE-2023-45810OpenFGA is a flexible authorization/permission engine built …7.5
• CVE-2023-45811Synchrony deobfuscator is a javascript cleaner & deobfuscato…7.8