PT-2026-65385 · Maven · Org.Xwiki.Contrib:Discussions-Server

CVE-2023-37465 · Published 2026-07-27 · Updated 2026-07-27

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Impact

It's possible to forge a request to delete a message.

Patches

The problem has been patched in version 2.0-rc-1 of Discussion Extension.

Workarounds

There's no easy workaround except upgrading.

References

https://jira.xwiki.org/browse/DISCUSSION-22

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki
• Email us at security mailing-list

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-37465

GHSA-4J38-RW27-97GX

Affected Products

Org.Xwiki.Contrib:Discussions-Server

References · 4

• https://osv.dev/vulnerability/GHSA-4j38-rw27-97gx · Vendor Advisory
• https://github.com/xwiki-contrib/application-discussions · Note
• https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx · Note
• https://jira.xwiki.org/browse/DISCUSSION-22 · Note