medium
5.3
CWE
200
Advisory Published
Updated

CVE-2023-23624: Discourse's exclude_tags param could leak which topics had a specific hidden tag

First published: Fri Jan 27 2023(Updated: )

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, someone can use the `exclude_tag param` to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. As a workaround, secure any categories that are using hidden tags, change any existing hidden tags to not include private data, or remove any hidden tags currently in use.

Credit: security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Discourse<3.0.1
Discourse=1.1.0-beta1
Discourse=1.1.0-beta2
Discourse=1.1.0-beta3
Discourse=1.1.0-beta4
Discourse=1.1.0-beta5
Discourse=1.1.0-beta6
Discourse=1.1.0-beta6b
Discourse=1.1.0-beta7
Discourse=1.1.0-beta8
Discourse=1.2.0-beta1
Discourse=1.2.0-beta2
Discourse=1.2.0-beta3
Discourse=1.2.0-beta4
Discourse=1.2.0-beta5
Discourse=1.2.0-beta6
Discourse=1.2.0-beta7
Discourse=1.2.0-beta8
Discourse=1.2.0-beta9
Discourse=1.3.0-beta1
Discourse=1.3.0-beta10
Discourse=1.3.0-beta11
Discourse=1.3.0-beta2
Discourse=1.3.0-beta3
Discourse=1.3.0-beta4
Discourse=1.3.0-beta5
Discourse=1.3.0-beta6
Discourse=1.3.0-beta7
Discourse=1.3.0-beta8
Discourse=1.3.0-beta9
Discourse=1.4.0-beta1
Discourse=1.4.0-beta10
Discourse=1.4.0-beta11
Discourse=1.4.0-beta12
Discourse=1.4.0-beta2
Discourse=1.4.0-beta3
Discourse=1.4.0-beta4
Discourse=1.4.0-beta5
Discourse=1.4.0-beta6
Discourse=1.4.0-beta7
Discourse=1.4.0-beta8
Discourse=1.4.0-beta9
Discourse=1.5.0-beta1
Discourse=1.5.0-beta10
Discourse=1.5.0-beta11
Discourse=1.5.0-beta12
Discourse=1.5.0-beta13
Discourse=1.5.0-beta13b
Discourse=1.5.0-beta14
Discourse=1.5.0-beta2
Discourse=1.5.0-beta3
Discourse=1.5.0-beta4
Discourse=1.5.0-beta5
Discourse=1.5.0-beta6
Discourse=1.5.0-beta7
Discourse=1.5.0-beta8
Discourse=1.5.0-beta9
Discourse=1.6.0-beta1
Discourse=1.6.0-beta10
Discourse=1.6.0-beta11
Discourse=1.6.0-beta12
Discourse=1.6.0-beta2
Discourse=1.6.0-beta3
Discourse=1.6.0-beta4
Discourse=1.6.0-beta5
Discourse=1.6.0-beta6
Discourse=1.6.0-beta7
Discourse=1.6.0-beta8
Discourse=1.6.0-beta9
Discourse=1.7.0-beta1
Discourse=1.7.0-beta10
Discourse=1.7.0-beta11
Discourse=1.7.0-beta2
Discourse=1.7.0-beta3
Discourse=1.7.0-beta4
Discourse=1.7.0-beta5
Discourse=1.7.0-beta6
Discourse=1.7.0-beta7
Discourse=1.7.0-beta8
Discourse=1.7.0-beta9
Discourse=1.8.0-beta1
Discourse=1.8.0-beta10
Discourse=1.8.0-beta11
Discourse=1.8.0-beta12
Discourse=1.8.0-beta13
Discourse=1.8.0-beta2
Discourse=1.8.0-beta3
Discourse=1.8.0-beta4
Discourse=1.8.0-beta5
Discourse=1.8.0-beta6
Discourse=1.8.0-beta7
Discourse=1.8.0-beta8
Discourse=1.8.0-beta9
Discourse=1.9.0-beta1
Discourse=1.9.0-beta10
Discourse=1.9.0-beta11
Discourse=1.9.0-beta12
Discourse=1.9.0-beta13
Discourse=1.9.0-beta14
Discourse=1.9.0-beta15
Discourse=1.9.0-beta16
Discourse=1.9.0-beta17
Discourse=1.9.0-beta2
Discourse=1.9.0-beta3
Discourse=1.9.0-beta4
Discourse=1.9.0-beta5
Discourse=1.9.0-beta6
Discourse=1.9.0-beta7
Discourse=1.9.0-beta8
Discourse=1.9.0-beta9
Discourse=2.0.0-beta1
Discourse=2.0.0-beta10
Discourse=2.0.0-beta2
Discourse=2.0.0-beta3
Discourse=2.0.0-beta4
Discourse=2.0.0-beta5
Discourse=2.0.0-beta6
Discourse=2.0.0-beta7
Discourse=2.0.0-beta8
Discourse=2.0.0-beta9
Discourse=2.1.0-beta1
Discourse=2.1.0-beta2
Discourse=2.1.0-beta3
Discourse=2.1.0-beta4
Discourse=2.1.0-beta5
Discourse=2.1.0-beta6
Discourse=2.2.0-beta1
Discourse=2.2.0-beta10
Discourse=2.2.0-beta2
Discourse=2.2.0-beta3
Discourse=2.2.0-beta4
Discourse=2.2.0-beta5
Discourse=2.2.0-beta6
Discourse=2.2.0-beta7
Discourse=2.2.0-beta8
Discourse=2.2.0-beta9
Discourse=2.3.0-beta1
Discourse=2.3.0-beta10
Discourse=2.3.0-beta11
Discourse=2.3.0-beta2
Discourse=2.3.0-beta3
Discourse=2.3.0-beta4
Discourse=2.3.0-beta5
Discourse=2.3.0-beta6
Discourse=2.3.0-beta7
Discourse=2.3.0-beta8
Discourse=2.3.0-beta9
Discourse=2.4.0-beta1
Discourse=2.4.0-beta10
Discourse=2.4.0-beta11
Discourse=2.4.0-beta2
Discourse=2.4.0-beta3
Discourse=2.4.0-beta4
Discourse=2.4.0-beta5
Discourse=2.4.0-beta6
Discourse=2.4.0-beta7
Discourse=2.4.0-beta8
Discourse=2.4.0-beta9
Discourse=2.5.0-beta1
Discourse=2.5.0-beta2
Discourse=2.5.0-beta3
Discourse=2.5.0-beta4
Discourse=2.5.0-beta5
Discourse=2.5.0-beta6
Discourse=2.5.0-beta7
Discourse=2.6.0-beta1
Discourse=2.6.0-beta2
Discourse=2.6.0-beta3
Discourse=2.6.0-beta4
Discourse=2.6.0-beta5
Discourse=2.6.0-beta6
Discourse=2.7.0-beta1
Discourse=2.7.0-beta2
Discourse=2.7.0-beta3
Discourse=2.7.0-beta4
Discourse=2.7.0-beta5
Discourse=2.7.0-beta6
Discourse=2.7.0-beta7
Discourse=2.7.0-beta8
Discourse=2.7.0-beta9
Discourse=2.8.0-beta1
Discourse=2.8.0-beta10
Discourse=2.8.0-beta11
Discourse=2.8.0-beta2
Discourse=2.8.0-beta3
Discourse=2.8.0-beta4
Discourse=2.8.0-beta5
Discourse=2.8.0-beta6
Discourse=2.8.0-beta7
Discourse=2.8.0-beta8
Discourse=2.8.0-beta9
Discourse=2.9.0-beta1
Discourse=2.9.0-beta10
Discourse=2.9.0-beta11
Discourse=2.9.0-beta12
Discourse=2.9.0-beta13
Discourse=2.9.0-beta14
Discourse=2.9.0-beta2
Discourse=2.9.0-beta3
Discourse=2.9.0-beta4
Discourse=2.9.0-beta5
Discourse=2.9.0-beta6
Discourse=2.9.0-beta7
Discourse=2.9.0-beta8
Discourse=2.9.0-beta9
Discourse=3.0.0-beta15
Discourse=3.0.0-beta16
Discourse=3.1.0-beta1

Remedy

https://github.com/discourse/discourse/commit/f55e0fe7910149c431861c18ce407d1be0d6091a

Remedy

https://github.com/discourse/discourse/pull/20006

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2023-23624?

    CVE-2023-23624 has a moderate severity level due to its potential to expose hidden topics based on tag filtering.

  • How do I fix CVE-2023-23624?

    To fix CVE-2023-23624, upgrade to Discourse version 3.0.1 or higher on the stable branch or 3.1.0.beta2 on the beta branches.

  • What impact does CVE-2023-23624 have on Discourse forums?

    CVE-2023-23624 allows users to exploit the exclude_tag parameter to infer hidden topics, posing a risk to user privacy.

  • Is CVE-2023-23624 present in all versions of Discourse?

    CVE-2023-23624 affects Discourse versions prior to 3.0.1 on the stable branch and 3.1.0.beta2 on the beta branches.

  • Who is affected by CVE-2023-23624?

    Any Discourse instances running vulnerable versions prior to the specified fixes are susceptible to the CVE-2023-23624 exploitation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203