# CVE-2023-22488: Missing authorization in Flarum > Attackers can bypass access restrictions to read private forum posts via email notifications if the Subscriptions extension is enabled. - **Severity:** Medium 6.8 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 12 Jan 2023 - **Updated:** 10 Mar 2025 - **Also known as:** GHSA-8gcg-vwmw-rxj4 ## What is CVE-2023-22488? CVE-2023-22488 is a medium-severity missing authorization vulnerability in flarum framework, published on 12 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. ### Official description Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through their different channels. The alerts do not leak data despite this as they are listed based on a visibility check, however, emails are still sent out. This means that, for extensions which restrict access to posts, any actor can bypass the restriction by subscribing to the discussion if the Subscriptions extension is enabled. The attack allows the leaking of some posts in the forum database, including posts awaiting approval, posts in tags the user has no access to if they could subscribe to a discussion before it becomes private, and posts restricted by third-party extensions. All Flarum versions prior to v1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible to v1.6.3. As a workaround, disable the Flarum Subscriptions extension or disable email notifications altogether. There are no other supported workarounds for this issue for Flarum versions below 1.6.3. Weakness: CWE-862 (Missing Authorization) ## Which versions are affected by CVE-2023-22488? 2 open source packages ship an affected version, including flarum/core. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `flarum/core` | Packagist | All versions | 1.6.3 | | `flarum/core` | Packagist | All versions | 1.6.3 | Products: Flarum Flarum. ## How do I fix CVE-2023-22488? Upgrade flarum/core to 1.6.3 or later. ## Is CVE-2023-22488 being exploited? There is no known exploitation of CVE-2023-22488 in the wild and no public exploit code. ## Other vulnerabilities in flarum framework - [CVE-2021-32671](https://insights.sbomify.com/CVE-2021-32671/): XSS vulnerability with translator (critical 10.0) - [CVE-2022-41938](https://insights.sbomify.com/CVE-2022-41938/): Cross site scripting vulnerability with discussion titles in flarum (critical 9.0) - [CVE-2019-13183](https://insights.sbomify.com/CVE-2019-13183/): Cross-site request forgery in n/a (high 8.8) - [CVE-2023-22487](https://insights.sbomify.com/CVE-2023-22487/): Post mentions can be used to read any post on the forum without access control (high 7.7) - [CVE-2019-11514](https://insights.sbomify.com/CVE-2019-11514/): Flarum mishandles invalidation of user email tokens (high 7.5) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2023-22488 and fix it if it is affected. What it is: CVE-2023-22488 is a medium-severity missing authorization vulnerability in flarum framework, published on 12 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of CVE-2023-22488 in the wild and no public exploit code. Affected packages and fixed versions: - flarum/core (Packagist): affected all versions; fixed in 1.6.3 - flarum/core (Packagist): affected all versions; fixed in 1.6.3 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2023-22488/ (Markdown: https://insights.sbomify.com/CVE-2023-22488/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2023-22488 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-22488 - OSV: https://osv.dev/vulnerability/CVE-2023-22488 --- From sbomify Insights: https://insights.sbomify.com/CVE-2023-22488/ Summaries are generated and may contain mistakes; the official description above is the record.