Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2022-46159

Any authenticated Discourse user can create an unlisted topic

Description

Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests-passed` branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take up unnecessary site resources. A patch for this issue is available in the `main` branch of Discourse. There are no known workarounds available.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • <= 2.8.13affected
  • >= 2.9.0.beta0, <= 2.9.0.beta14affected

References