CVE-2023-37904

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.6 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
GitHub_MCNA
2.6 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
discoursediscourse
𝑥
< 3.0.6
discoursediscourse
1.1.0:beta1
discoursediscourse
1.1.0:beta2
discoursediscourse
1.1.0:beta3
discoursediscourse
1.1.0:beta4
discoursediscourse
1.1.0:beta5
discoursediscourse
1.1.0:beta6
discoursediscourse
1.1.0:beta6b
discoursediscourse
1.1.0:beta7
discoursediscourse
1.1.0:beta8
discoursediscourse
1.2.0:beta1
discoursediscourse
1.2.0:beta2
discoursediscourse
1.2.0:beta3
discoursediscourse
1.2.0:beta4
discoursediscourse
1.2.0:beta5
discoursediscourse
1.2.0:beta6
discoursediscourse
1.2.0:beta7
discoursediscourse
1.2.0:beta8
discoursediscourse
1.2.0:beta9
discoursediscourse
1.3.0:beta1
discoursediscourse
1.3.0:beta10
discoursediscourse
1.3.0:beta11
discoursediscourse
1.3.0:beta2
discoursediscourse
1.3.0:beta3
discoursediscourse
1.3.0:beta4
discoursediscourse
1.3.0:beta5
discoursediscourse
1.3.0:beta6
discoursediscourse
1.3.0:beta7
discoursediscourse
1.3.0:beta8
discoursediscourse
1.3.0:beta9
discoursediscourse
1.4.0:beta1
discoursediscourse
1.4.0:beta10
discoursediscourse
1.4.0:beta11
discoursediscourse
1.4.0:beta12
discoursediscourse
1.4.0:beta2
discoursediscourse
1.4.0:beta3
discoursediscourse
1.4.0:beta4
discoursediscourse
1.4.0:beta5
discoursediscourse
1.4.0:beta6
discoursediscourse
1.4.0:beta7
discoursediscourse
1.4.0:beta8
discoursediscourse
1.4.0:beta9
discoursediscourse
1.5.0:beta1
discoursediscourse
1.5.0:beta10
discoursediscourse
1.5.0:beta11
discoursediscourse
1.5.0:beta12
discoursediscourse
1.5.0:beta13
discoursediscourse
1.5.0:beta13b
discoursediscourse
1.5.0:beta14
discoursediscourse
1.5.0:beta2
discoursediscourse
1.5.0:beta3
discoursediscourse
1.5.0:beta4
discoursediscourse
1.5.0:beta5
discoursediscourse
1.5.0:beta6
discoursediscourse
1.5.0:beta7
discoursediscourse
1.5.0:beta8
discoursediscourse
1.5.0:beta9
discoursediscourse
1.6.0:beta1
discoursediscourse
1.6.0:beta10
discoursediscourse
1.6.0:beta11
discoursediscourse
1.6.0:beta12
discoursediscourse
1.6.0:beta2
discoursediscourse
1.6.0:beta3
discoursediscourse
1.6.0:beta4
discoursediscourse
1.6.0:beta5
discoursediscourse
1.6.0:beta6
discoursediscourse
1.6.0:beta7
discoursediscourse
1.6.0:beta8
discoursediscourse
1.6.0:beta9
discoursediscourse
1.7.0:beta1
discoursediscourse
1.7.0:beta10
discoursediscourse
1.7.0:beta11
discoursediscourse
1.7.0:beta2
discoursediscourse
1.7.0:beta3
discoursediscourse
1.7.0:beta4
discoursediscourse
1.7.0:beta5
discoursediscourse
1.7.0:beta6
discoursediscourse
1.7.0:beta7
discoursediscourse
1.7.0:beta8
discoursediscourse
1.7.0:beta9
discoursediscourse
1.8.0:beta1
discoursediscourse
1.8.0:beta10
discoursediscourse
1.8.0:beta11
discoursediscourse
1.8.0:beta12
discoursediscourse
1.8.0:beta13
discoursediscourse
1.8.0:beta2
discoursediscourse
1.8.0:beta3
discoursediscourse
1.8.0:beta4
discoursediscourse
1.8.0:beta5
discoursediscourse
1.8.0:beta6
discoursediscourse
1.8.0:beta7
discoursediscourse
1.8.0:beta8
discoursediscourse
1.8.0:beta9
discoursediscourse
1.9.0:beta1
discoursediscourse
1.9.0:beta10
discoursediscourse
1.9.0:beta11
discoursediscourse
1.9.0:beta12
discoursediscourse
1.9.0:beta13
discoursediscourse
1.9.0:beta14
discoursediscourse
1.9.0:beta15
discoursediscourse
1.9.0:beta16
discoursediscourse
1.9.0:beta17
discoursediscourse
1.9.0:beta2
discoursediscourse
1.9.0:beta3
discoursediscourse
1.9.0:beta4
discoursediscourse
1.9.0:beta5
discoursediscourse
1.9.0:beta6
discoursediscourse
1.9.0:beta7
discoursediscourse
1.9.0:beta8
discoursediscourse
1.9.0:beta9
discoursediscourse
2.0.0:beta1
discoursediscourse
2.0.0:beta10
discoursediscourse
2.0.0:beta2
discoursediscourse
2.0.0:beta3
discoursediscourse
2.0.0:beta4
discoursediscourse
2.0.0:beta5
discoursediscourse
2.0.0:beta6
discoursediscourse
2.0.0:beta7
discoursediscourse
2.0.0:beta8
discoursediscourse
2.0.0:beta9
discoursediscourse
2.1.0:beta1
discoursediscourse
2.1.0:beta2
discoursediscourse
2.1.0:beta3
discoursediscourse
2.1.0:beta4
discoursediscourse
2.1.0:beta5
discoursediscourse
2.1.0:beta6
discoursediscourse
2.2.0:beta1
discoursediscourse
2.2.0:beta10
discoursediscourse
2.2.0:beta2
discoursediscourse
2.2.0:beta3
discoursediscourse
2.2.0:beta4
discoursediscourse
2.2.0:beta5
discoursediscourse
2.2.0:beta6
discoursediscourse
2.2.0:beta7
discoursediscourse
2.2.0:beta8
discoursediscourse
2.2.0:beta9
discoursediscourse
2.3.0:beta1
discoursediscourse
2.3.0:beta10
discoursediscourse
2.3.0:beta11
discoursediscourse
2.3.0:beta2
discoursediscourse
2.3.0:beta3
discoursediscourse
2.3.0:beta4
discoursediscourse
2.3.0:beta5
discoursediscourse
2.3.0:beta6
discoursediscourse
2.3.0:beta7
discoursediscourse
2.3.0:beta8
discoursediscourse
2.3.0:beta9
discoursediscourse
2.4.0:beta1
discoursediscourse
2.4.0:beta10
discoursediscourse
2.4.0:beta11
discoursediscourse
2.4.0:beta2
discoursediscourse
2.4.0:beta3
discoursediscourse
2.4.0:beta4
discoursediscourse
2.4.0:beta5
discoursediscourse
2.4.0:beta6
discoursediscourse
2.4.0:beta7
discoursediscourse
2.4.0:beta8
discoursediscourse
2.4.0:beta9
discoursediscourse
2.5.0:beta1
discoursediscourse
2.5.0:beta2
discoursediscourse
2.5.0:beta3
discoursediscourse
2.5.0:beta4
discoursediscourse
2.5.0:beta5
discoursediscourse
2.5.0:beta6
discoursediscourse
2.5.0:beta7
discoursediscourse
2.6.0:beta1
discoursediscourse
2.6.0:beta2
discoursediscourse
2.6.0:beta3
discoursediscourse
2.6.0:beta4
discoursediscourse
2.6.0:beta5
discoursediscourse
2.6.0:beta6
discoursediscourse
2.7.0:beta1
discoursediscourse
2.7.0:beta2
discoursediscourse
2.7.0:beta3
discoursediscourse
2.7.0:beta4
discoursediscourse
2.7.0:beta5
discoursediscourse
2.7.0:beta6
discoursediscourse
2.7.0:beta7
discoursediscourse
2.7.0:beta8
discoursediscourse
2.7.0:beta9
discoursediscourse
2.8.0:beta1
discoursediscourse
2.8.0:beta10
discoursediscourse
2.8.0:beta11
discoursediscourse
2.8.0:beta2
discoursediscourse
2.8.0:beta3
discoursediscourse
2.8.0:beta4
discoursediscourse
2.8.0:beta5
discoursediscourse
2.8.0:beta6
discoursediscourse
2.8.0:beta7
discoursediscourse
2.8.0:beta8
discoursediscourse
2.8.0:beta9
discoursediscourse
2.9.0:beta1
discoursediscourse
2.9.0:beta10
discoursediscourse
2.9.0:beta11
discoursediscourse
2.9.0:beta12
discoursediscourse
2.9.0:beta13
discoursediscourse
2.9.0:beta14
discoursediscourse
2.9.0:beta2
discoursediscourse
2.9.0:beta3
discoursediscourse
2.9.0:beta4
discoursediscourse
2.9.0:beta5
discoursediscourse
2.9.0:beta6
discoursediscourse
2.9.0:beta7
discoursediscourse
2.9.0:beta8
discoursediscourse
2.9.0:beta9
discoursediscourse
3.0.0:beta15
discoursediscourse
3.0.0:beta16
discoursediscourse
3.1.0:beta1
discoursediscourse
3.1.0:beta2
discoursediscourse
3.1.0:beta3
discoursediscourse
3.1.0:beta5
discoursediscourse
3.1.0:beta6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/discourse/discourse/commit/62a609ea2d0645a27ee8adbb01ce10a5e03a600b
https://github.com/discourse/discourse/security/advisories/GHSA-6wj5-4ph2-c7qg
https://github.com/discourse/discourse/commit/62a609ea2d0645a27ee8adbb01ce10a5e03a600b
https://github.com/discourse/discourse/security/advisories/GHSA-6wj5-4ph2-c7qg