CVE-2023-22737: wire-server provides back end services for Wire, a team communication and collaboration platform

Q: How do I fix CVE-2023-22737?

wire: upgrade to 2022-12-09. Exact commands for each OS are on this page.

Q: Is CVE-2023-22737 being exploited?

CVE-2023-22737 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2023-22737 affect?

CVE-2023-22737 affects wire. Severity is medium (CVSS 6.5). wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conv

Q: How urgent is CVE-2023-22737?

Priority 36/100. No elevated risk signals yet.

Routine

MEDIUM 6.5UPGRADE

CVE-2023-22737 is a medium-severity flaw (CVSS 6.5) affecting wire. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins should be able to remove Bots. Regular Conversations are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed services. On-premise insta

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.7% (top 46%)
CISA exploited list	No
Weakness	CWE-280, CWE-862
Published	2023-01-28
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: wire

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-01-28 00:15 UTCPublished CVE record published
2026-06-17 05:36 UTCUpdated Record last modified

wire wire UPGRADE

Affected: < 2022-12-09

Fixed in: 2022-12-09

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy wire || rpm -q wire || wire --version

2. UPGRADE to 2022-12-09 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade wire

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade wire

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-22737?

wire: upgrade to 2022-12-09. Exact commands for each OS are on this page.

Is CVE-2023-22737 being exploited?

CVE-2023-22737 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-22737 affect?

CVE-2023-22737 affects wire. Severity is medium (CVSS 6.5). wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conv

How urgent is CVE-2023-22737?

Priority 36/100. No elevated risk signals yet.

Related CVEs

CVE-2026-45799 HIGH 7.5 UPGRADE Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java
CVE-2022-43673 MEDIUM 4.7 UPGRADE Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retri
CVE-2022-31009 MEDIUM 5.7 UPGRADE wire-ios is an iOS client for the Wire secure messaging application
CVE-2022-23625 MEDIUM 6.5 UPGRADE UPGRADE Wire-ios is a messaging application using the wire protocol on apple's ios platform
CVE-2021-41094 MEDIUM 4.2 UPGRADE Wire is an open source secure messenger

References

← Back to latest CVEs