CVE-2022-41944

LOW

Discourse < 2.8.11 - Information Disclosure

Title source: rule
STIX 2.1

Description

Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain conditions, a user can see notifications for topics they no longer have access to. If there is sensitive information in the topic title, it will therefore have been exposed. This issue is patched in stable version 2.8.12, beta version 2.9.0.beta13, and tests-passed version 2.9.0.beta13. There are no workarounds available.

References (2)

Core 2

Scores

CVSS v3 3.5
EPSS 0.0019
EPSS Percentile 40.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-863
Status published
Products (2)
discourse/discourse 2.9.0 beta1 (12 CPE variants)
discourse/discourse < 2.8.11
Published Nov 28, 2022
Tracked Since Feb 18, 2026