---
id: CVE-2023-37465
aliases:
  - GHSA-4j38-rw27-97gx
title: >-
  org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF)
  issue that makes it possible to delete messages
summary: >-
  org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF)
  issue that makes it possible to delete messages
severity: medium
cvss: 6.5
cwe:
  - CWE-352
vendor: xwiki
product: 'org.xwiki.contrib:discussions-server'
ecosystem: maven
affected:
  - 'org.xwiki.contrib:discussions-server < 2.0-rc-1'
patched:
  - 'org.xwiki.contrib:discussions-server 2.0-rc-1'
published: '2026-07-27'
updated: '2026-07-27'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4j38-rw27-97gx'
references:
  - url: >-
      https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx
  - url: 'https://jira.xwiki.org/browse/DISCUSSION-22'
  - url: 'https://github.com/advisories/GHSA-4j38-rw27-97gx'
tags:
  - ghsa
  - maven
ingestedAt: '2026-07-27T17:21:55.832Z'
---

## Overview

### Impact
It's possible to forge a request to delete a message. 

### Patches
The problem has been patched in version 2.0-rc-1 of Discussion Extension.

### Workarounds
There's no easy workaround except upgrading.

### References
https://jira.xwiki.org/browse/DISCUSSION-22

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security mailing-list](mailto:security@xwiki.org)

## Affected packages

- `org.xwiki.contrib:discussions-server < 2.0-rc-1`

## Remediation

Upgrade to a patched release:

- `org.xwiki.contrib:discussions-server 2.0-rc-1`