Summary
Users can edit the tags of any discussion
This advisory concerns a vulnerability which was patched and publicly released on October 5, 2020.
Workarounds
Version v0.1.0-beta.13.2 of the Tags extension allows existing Flarum beta 13 forums to fix the issue without the need to update to beta 14.
Forums that have not yet updated to Flarum beta 13 are encouraged to update as soon as possible.
References
For more information
If you have any questions or comments about this advisory, please start a new discussion on our support forum.
If you discover a security vulnerability within Flarum, please send an e-mail to [email protected]. All security vulnerabilities will be promptly addressed. More details can be found in our security policy.
Impact
This vulnerability allowed any registered user to edit the tags of any discussion for which they have READ access using the REST API.
Users were able to remove any existing tag, and add any tag in which they are allowed to create discussions. The chosen tags still had to match the configured Tags minimums and maximums.
By moving the discussion to new tags, users were able to go around permissions applied to restricted tags. Depending on the setup, this can include publicly exposing content that was only visible to certain groups, or gain the ability to interact with content where such interaction was limited.
The full impact varies depending on the configuration of permissions and restricted tags, and which community extensions are being used. All tag-scoped permissions offered by extensions are impacted by this ability to go around them.
Forums that don't use restricted tags and don't use any extension that relies on tags for access control should not see any security impact. An update is still required to stop users from being able to change any discussion's tags.
Forums that don't use the Tags extension are unaffected.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The fix will be available in version v0.1.0-beta.14 with Flarum beta 14. The fix has already been back-ported to Flarum beta 13 as version v0.1.0-beta.13.2 of the Tags extension.
Frequently Asked Questions
- What is GHSA-32WX-4GXX-H48F? GHSA-32WX-4GXX-H48F is a medium-severity security vulnerability in flarum/tags (composer), affecting versions <= 0.1.0-beta.13. It is fixed in 0.1.0-beta.13.2.
- Which versions of flarum/tags are affected by GHSA-32WX-4GXX-H48F? flarum/tags (composer) versions <= 0.1.0-beta.13 is affected.
- Is there a fix for GHSA-32WX-4GXX-H48F? Yes. GHSA-32WX-4GXX-H48F is fixed in 0.1.0-beta.13.2. Upgrade to this version or later.
- Is GHSA-32WX-4GXX-H48F exploitable, and should I be worried? Whether GHSA-32WX-4GXX-H48F is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-32WX-4GXX-H48F is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-32WX-4GXX-H48F? Upgrade
flarum/tagsto 0.1.0-beta.13.2 or later.