Low severity3.1NVD Advisory· Published Mar 6, 2023· Updated Jun 17, 2026

CVE-2023-25169

Description

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is included in the latest version of the Discourse Yearly Review plugin. Users are advised to upgrade. Users unable to upgrade may disable the yearly_review_enabled setting to fully mitigate the issue. Also, it's possible to edit the anonymised user's old data in the yearly review topics manually.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Discourse (software)/Discourse Yearly Review
cpe:2.3:a:discourse:discourse_yearly_review:*:*:*:*:*:discourse:*:*
Range: <0.2
Discourse (software)/Discourse Code Reviewllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: < 0.2

Patches

Vulnerability mechanics

References

github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3cnvdPatch
github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7nvdMitigationVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000