CVE-2023-45147

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 Discourse versions prior to 3.2.0.beta2

Description Discourse is an open source community platform. In affected versions, any user can create a topic and add arbitrary custom fields to a topic. The severity of this issue depends on what plugins are installed and how the plugins use topic custom fields. For a default Discourse installation with the default plugins, this issue has no impact.

Recommendations For versions prior to 3.1.1 on the stable branch, update to version 3.1.1. For versions prior to 3.2.0.beta2 on the beta branch, update to version 3.2.0.beta2. If an update is not possible, disable any plugins that access topic custom fields as a temporary workaround.