CVSS 3.1 Score 9.0 of 10 (high)


Published Feb 21, 2024
Updated: Feb 22, 2024
CWE ID 863


CVE-2023-46241 is a vulnerability affecting the "discourse-microsoft-auth" plugin, which allows authentication via Microsoft. It can potentially enable an attacker to take control of a victim's Discourse account. The vulnerability only affects sites that have configured their application's account type to options other than "Accounts in this organizational directory only (O365 only - Single tenant)". The issue has been patched in commit c40665f44509724b64938c85def9fb2e79f62ec8 of the plugin, and a rake task called "microsoft_auth:revoke" has been added to deactivate and log out all users who have connected their accounts to Microsoft. User API keys and API keys created by those users will also be revoked, and connection records to Microsoft will be removed. A workaround for the vulnerability is to disable the "discourse-microsoft-auth" plugin. The potential danger of this vulnerability lies in the unauthorized access and control over user accounts, posing a high risk to organizations' confidentiality, integrity, and availability.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-46241 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options