CVE-2022-24850: Category group permissions leaked in Discourse
Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should only be available to the users that can manage a category. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no workarounds for this problem.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2022-24850.
What is the severity level of CVE-2022-24850?
The severity level of CVE-2022-24850 is medium with a CVSS score of 4.3.
How can I check if my Discourse version is affected by CVE-2022-24850?
You can check if your Discourse version is affected by CVE-2022-24850 by verifying if you are using version 2.8.2, 2.9.0-beta1, 2.9.0-beta2, or 2.9.0-beta3.
Is there a fix available for CVE-2022-24850?
A fix for CVE-2022-24850 may be available in a future update from Discourse. Please check with Discourse for patch information.
Where can I find more information about CVE-2022-24850?
You can find more information about CVE-2022-24850 on the GitHub security advisory page provided in the references.