Skip to content
CVE PROGRAM SOURCE RECORD2.2 Low

CVE-2024-52589

Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • stable: <= 3.3.2affected
  • beta: <= 3.4.0.beta2affected
  • tests-passed: <= 3.4.0.beta2affected

References