How severe is CVE-2023-22487?

CVE-2023-22487 has a CVSS score of 7.7/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2023-22487?

CVE-2023-22487 affects the following packages: flarum/mentions (Packagist). Ecosystems affected: Packagist.

How do I fix CVE-2023-22487?

Update flarum/mentions to 1.6.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-22487 is resolved across your whole dependency graph.

How do I detect CVE-2023-22487 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for flarum/mentions, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2023-22487 if there is no patch (or I can't update yet)?

Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Is CVE-2023-22487 actively exploited in the wild?

Yes. There are 1 known exploit references for CVE-2023-22487, including 1 in-the-wild exploitation observed on GitHub and other sources. Treat this as actively exploitable and prioritize patching immediately. All exploit code should only be run in an isolated sandbox environment for research or authorized testing — never against production systems without explicit written authorization.

What is the EPSS score for CVE-2023-22487?

CVE-2023-22487 has an EPSS (Exploit Prediction Scoring System) score of 0.7%, placing it in the 53th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2023-22487?

CVE-2023-22487 is classified as CWE-284 (CWE-284). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2023-22487 published, and has it been updated?

CVE-2023-22487 was published on January 11, 2023 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘

🐘 Packagist

Not in CISA KEV

HIGH severity

CVE-2023-22487 — mentions

HIGHFix: flarum/framework@ab1c868

CVE-2023-22487 is a high-severity (CVSS 7.7) CWE-284 vulnerability in flarum/mentions. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for flarum/mentions — see the affected versions and patch details below.

Post mentions can be used to read any post on the forum without access control

Also known asGHSA-22m9-m3ww-53h3

Published

Jan 11, 2023

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

1 known

Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2023-22487.

EPSS Exploitation Probability

via FIRST.org ↗

0.7%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs53th percentile — riskier than 53% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

🐘flarum/mentions

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special @"<username>"#p<id> syntax.

The following behavior never changes no matter if the actor should be able to read the mentioned post or not:

A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number.

The mentionsPosts relationship included in the POST /api/posts and PATCH /api/posts/<id> JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions.

An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward.

Impact

The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events.

The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown.

All Flarum versions prior to v1.6.3 are affected.

Patches

The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum have to upgrade as soon as possible to v1.6.3 using:

composer update --prefer-dist --no-dev -a -W

You can then confirm you run the latest version using:

composer show flarum/core

Workarounds

Disable the mentions extension.

For more information

For any questions or comments on this vulnerability please visit https://discuss.flarum.org/

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [email protected], and we will address it promptly.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`flarum/mentions`	all versions	1.6.3`composer require flarum/mentions:^1.6.3`

Affected Products

1 product · 1 configurations

Application

flarumflarum

< 1.6.3

range

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Flarum is a forum software for building communities. Using the mentions …

github.comNVDJan 2023

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for flarum/mentions, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update flarum/mentions to 1.6.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-22487 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content