CVE-2022-41944CWE-200

Discourse users can see notifications for topics they no longer have access to

Low · published November 28, 2022

CVSS v3.1
3.5
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain conditions, a user can see notifications for topics they no longer have access to. If there is sensitive information in the topic title, it will therefore have been exposed. This issue is patched in stable version 2.8.12, beta version 2.9.0.beta13, and tests-passed version 2.9.0.beta13. There are no workarounds available.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00490 · 41.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-11-28T00:00Z
EPSS history
Timeline
  • 28 NOV 00:00Z
    Discourse users can see notifications for topics they no longer have access to
    cvelistv5