Post mentions can be used to read any post on the forum without access control

CVE-2023-22487

What is CVE-2023-22487?

The Flarum forum software contains a vulnerability within its mentions feature, allowing users to exploit URL injection into posts. This occurs through the syntax @"<username>"#p<id>, which indiscriminately inserts links to posts, potentially disclosing sensitive information even if the user lacks permissions. The vulnerability reveals the complete JSON:API payload of mentioned posts in the API responses, exposing content, dates, and various attributes without proper access control. An attacker only requires permission to create posts, making it feasible to misuse even under moderated conditions. This issue has been resolved in version 1.6.3; users are advised to disable the mentions extension as a temporary workaround.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References