CVE-2021-41082: Private message title and participating users leaked in discourse
Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the tests-passed branch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41082?
CVE-2021-41082 has a medium severity rating as it allows the exposure of private message titles and participants to unauthorized users.
How do I fix CVE-2021-41082?
To fix CVE-2021-41082, update Discourse to the latest version released after September 14, 2021.
What versions of Discourse are affected by CVE-2021-41082?
CVE-2021-41082 affects all Discourse versions up to but not including 2021-09-14.
What information is exposed due to CVE-2021-41082?
CVE-2021-41082 exposes the titles and participating users of private messages to users who do not have access to those messages.
Is access control for private messages compromised in CVE-2021-41082?
No, while CVE-2021-41082 exposes some information, the access control for private messages remains intact.