Read the docs
TI-2023-26763 Aliases CVE-2023-49098

Reaction data for user notifications exposed in Discourse-reactions

Priority LOW 17CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00307 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
discoursediscourse-reactions< commit 2c26939—No fix listedCNA
  • discourse-reactions Vendordiscourse Affected < commit 2c26939 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:discourse:discourse_reactions:*:*:*:*:*:discourse:*:*up to 0.4Vulnerablediscourse
  • cpe:2.3:a:discourse:discourse_reactions:*:*:*:*:*:discourse:*:* Versions up to 0.4 Vulnerable ·discourse

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49098

References

Patch 1

Advisory 1

  • TI-2021-17979 Reactions leak for secure category topics and private messages CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences