CVE-2023-46241 is a critical severity (CVSS 9.0) flaw in the discourse-microsoft-auth plugin that can let an attacker take over a victim's Discourse account. Sites using any account type other than single tenant are exposed. Update the plugin past the patch commit and run the revoke rake task.
What's affected
Sites with the plugin enabled are vulnerable if the Microsoft application account type is anything other than "Accounts in this organizational directory only (O365 only, Single tenant)". The GitHub advisory says versions up to and including commit 9543d188 are affected and later versions are patched. The record names the patch commit c40665f44509724b64938c85def9fb2e79f62ec8.
The advisory title points to unverified emails from the Microsoft identity platform as the cause, and it does not describe the mechanism further. The record scores it 9.0 critical and assigns CWE-863, incorrect authorization.
The NVD record scores it 9.0 (Critical) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-863 (incorrect authorization). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check two things. First, whether the plugin is installed and enabled: the site setting is microsoft_auth_enabled. Second, which account type your Microsoft application registration uses, which you can see in the Microsoft Entra portal for the app.
Then compare your plugin checkout with the patch commit. If your plugin was last updated before that commit, you are behind. Rebuilding the Discourse container normally pulls the latest plugin code.
What to do now
- Update discourse-microsoft-auth to a version that includes the patch commit, by rebuilding your Discourse instance.
- Run the microsoft_auth:revoke rake task, which deactivates and logs out users connected to Microsoft, revokes their API keys and removes connection records.
- If you cannot update at once, set microsoft_auth_enabled to false and run microsoft_auth:log_out_users.
- Ask affected users to re-verify their email and reconnect Microsoft sign in.
- Review recent admin and moderator account activity.
Why it matters
Sign in with Microsoft is only as strong as the identity claims the site trusts. If an application accepts an email that Microsoft did not verify, anyone who controls a matching tenant can claim to be that person. This is an authorization mistake in how identities are mapped to local accounts.
Because the result is account takeover, including accounts with elevated roles, the patch alone is not enough. The revoke task exists to clear sessions and keys that an attacker may already hold.
Quick check
Am I safe with single tenant accounts?
The advisory says only sites using account types other than single tenant are vulnerable.
Is updating enough?
The advisory also adds the revoke task so existing connections and keys can be reset.
Sources
Last reviewed: 19 October 2026.
