Skip to content
OpenAdvisories
High · 8.6 CVE-2023-48297 EUVD-2023-52358

Discourse vulnerable to unlimited mentioned users in message serializer

Published Jan 12, 2024 · Updated Jun 17, 2025 · Assigned by GitHub_M

Description

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

Affected products

VendorProductAffectedFixed
discourse discourse < 3.1.4, >= 3.2.0beta1, < 3.2.0.beta4 —

References