SB2023012021 - Multiple vulnerabilities in Flarum

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023012021

SB2023012021 - Multiple vulnerabilities in Flarum

Published: January 20, 2023 Updated: April 20, 2026

Security Bulletin ID SB2023012021
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2023-22487)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and read any post on the forum.


2) Missing Authorization (CVE-ID: CVE-2023-22488)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing authorization in the notification-sending component. A remote user can obtain sensitive information from notifications.


3) Missing Authorization (CVE-ID: CVE-2023-22489)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass reply restrictions and post replies in public discussions.

The vulnerability exists due to improper access control in the Flarum REST API when creating replies to a visible discussion whose first post was permanently deleted. A remote user can send a reply creation request to bypass reply restrictions and post replies in public discussions.

The issue occurs only if the discussion remains visible after the first post is deleted, such as when it still has at least one approved reply. User interaction is required because the user must submit a reply.


Remediation

Install update from vendor's website.

References