CVE-2023-22488 Missing authorization in Flarum

What is CVE-2023-22488?

CVE-2023-22488 is a medium-severity missing authorization vulnerability in flarum framework, published on 12 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through their different channels. The alerts do not leak data despite this as they are listed based on a visibility check, however, emails are still sent out. This means that, for extensions which restrict access to posts, any actor can bypass the restriction by subscribing to the discussion if the Subscriptions extension is enabled. The attack allows the leaking of some posts in the forum database, including posts awaiting approval, posts in tags the user has no access to if they could subscribe to a discussion before it becomes private, and posts restricted by third-party extensions. All Flarum versions prior to v1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible to v1.6.3. As a workaround, disable the Flarum Subscriptions extension or disable email notifications altogether. There are no other supported workarounds for this issue for Flarum versions below 1.6.3.

Weakness: CWE-862

Which versions are affected by CVE-2023-22488?

2 open source packages ship an affected version, including flarum/core. It affects 1 product.

Products include Flarum Flarum.

How do I fix CVE-2023-22488?

Upgrade flarum/core to 1.6.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-22488 being exploited?

There is no known exploitation of CVE-2023-22488 in the wild and no public exploit code.

Other vulnerabilities in flarum framework

• CVE-2021-32671 XSS vulnerability with translator Critical 10.0
• CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum Critical 9.0
• CVE-2019-13183 Cross-site request forgery in n/a High 8.8
• CVE-2023-22487 Post mentions can be used to read any post on the forum without access control High 7.7
• CVE-2019-11514 Flarum mishandles invalidation of user email tokens High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8gcg-vwmw-rxj4.