CVE-2024-52589CWE-200

Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Low · published December 19, 2024

CVSS v3.1
2.2
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-12-19T19:13Z
EPSS history
Timeline
  • 19 DEC 19:13Z
    Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse
    cvelistv5