{"answers":{"affected":"2 open source packages ship an affected version, including flarum/core. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-22489 in the wild and no public exploit code.","fix":"Upgrade flarum/core to 1.6.3 or later.","what":"CVE-2023-22489 is a low-severity missing authorization vulnerability in flarum framework, published on 13 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-22489 and fix it if it is affected.\n\nWhat it is: CVE-2023-22489 is a low-severity missing authorization vulnerability in flarum framework, published on 13 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2023-22489 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- flarum/core (Packagist): affected from 1.3.0; fixed in 1.6.3\n- flarum/core (Packagist): affected from 1.3.0; fixed in 1.6.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-22489/ (Markdown: https://insights.sbomify.com/CVE-2023-22489/index.md)","id":"CVE-2023-22489","markdown":"https://insights.sbomify.com/CVE-2023-22489/index.md","name":"CVE-2023-22489","record":{"aliases":["GHSA-hph3-hv3c-7725"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Flarum discussion platform","requires_auth":"low_privilege","summary":"Attackers can bypass reply permissions and locks to post unauthorized replies in discussions where the first post was deleted, potentially enabling spam or unsolicited emails.","user_interaction":"required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"flarum","vendor":"flarum"}],"cvss":{"score":3.5,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that don't have a validated email. Guests cannot successfully create a reply because the API will fail with a 500 error when the user ID 0 is inserted into the database. This happens because when the first post of a discussion is permanently deleted, the `first_post_id` attribute of the discussion becomes `null` which causes access control to be skipped for all new replies. Flarum automatically makes discussions with zero comments invisible so an additional condition for this vulnerability is that the discussion must have at least one approved reply so that `discussions.comment_count` is still above zero after the post deletion. This can open the discussion to uncontrolled spam or just unintentional replies if users still had their tab open before the vulnerable discussion was locked and then post a reply when they shouldn't be able to. In combination with the email notification settings, this could also be used as a way to send unsolicited emails. Versions between `v1.3.0` and `v1.6.3` are impacted. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible. There are no known workarounds.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Flarum is missing authorization in discussion replies","id":"CVE-2023-22489","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2023"},"n_packages":2,"n_references":3,"next":{"headline":"Git vulnerable to local clone-based data exfiltration with non-local transports","id":"CVE-2023-22490"},"packages":[{"ecosystem":"Packagist","fixed":["1.6.3"],"introduced":["1.3.0"],"last_affected":[],"package":"flarum/core","purl":null,"source":"GHSA-hph3-hv3c-7725"},{"ecosystem":"Packagist","fixed":["1.6.3"],"introduced":["1.3.0"],"last_affected":[],"package":"flarum/core","purl":"pkg:composer/flarum/core","source":"GHSA-hph3-hv3c-7725"}],"prev":{"headline":"Missing authorization in Flarum","id":"CVE-2023-22488"},"products":["framework"],"published":"2023-01-13","related":[{"cvss_score":10,"headline":"XSS vulnerability with translator","id":"CVE-2021-32671","kev_date_added":null,"published":"2021-06-07"},{"cvss_score":9,"headline":"Cross site scripting vulnerability with discussion titles in flarum","id":"CVE-2022-41938","kev_date_added":null,"published":"2022-11-19"},{"cvss_score":8.8,"headline":"Cross-site request forgery in n/a","id":"CVE-2019-13183","kev_date_added":null,"published":"2019-07-07"},{"cvss_score":7.7,"headline":"Post mentions can be used to read any post on the forum without access control","id":"CVE-2023-22487","kev_date_added":null,"published":"2023-01-11"},{"cvss_score":7.5,"headline":"Flarum mishandles invalidation of user email tokens","id":"CVE-2019-11514","kev_date_added":null,"published":"2019-04-25"},{"cvss_score":7.1,"headline":"Server-Side Request Forgery via Avatar upload in flarum","id":"CVE-2023-40033","kev_date_added":null,"published":"2023-08-16"},{"cvss_score":6.8,"headline":"Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite","id":"CVE-2025-27794","kev_date_added":null,"published":"2025-03-12"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-03-10","vendors":["flarum"]},"summary":"Attackers can bypass reply permissions and locks to post unauthorized replies in discussions where the first post was deleted, potentially enabling spam or unsolicited emails.","url":"https://insights.sbomify.com/CVE-2023-22489/"}