CVE-2021-37693

MEDIUM

Discourse < 2.7.8 - Insufficient Session Expiration via Email Verification Token

Title source: llm
STIX 2.1

Description

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0083
EPSS Percentile 52.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-613 CWE-640
Status published
Products (2)
discourse/discourse 2.8.0 beta1 (3 CPE variants)
discourse/discourse < 2.7.8
Published Aug 13, 2021
Tracked Since Feb 18, 2026