Unrated severityNVD Advisory· Published Mar 6, 2023· Updated Feb 25, 2025
Yearly Review Plugin leaking anonymised users data in discourse-yearly-review
CVE-2023-25169
Description
discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is included in the latest version of the Discourse Yearly Review plugin. Users are advised to upgrade. Users unable to upgrade may disable the yearly_review_enabled setting to fully mitigate the issue. Also, it's possible to edit the anonymised user's old data in the yearly review topics manually.
Affected products
1- Range: < 0.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3cmitrex_refsource_MISC
- github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.