CVE-2022-31025: Invite bypasses user approval in Discourse
Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the stable branch and 2.9.0beta5 on the beta and tests-passed branches, inviting users on sites that use single sign-on could bypass the mustapproveusers check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the stable branch and version 2.9.0.beta5 on the beta and tests-passed branches. As a workaround, disable invites or increase mintrustleveltoallowinvite to reduce the attack surface to more trusted users.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31025?
CVE-2022-31025 has a medium severity rating due to its potential impact on user management.
How do I fix CVE-2022-31025?
To fix CVE-2022-31025, update Discourse to version 2.8.4 or later on the stable branch or 2.9.0-beta5 or later on the beta and tests-passed branches.
What versions of Discourse are affected by CVE-2022-31025?
CVE-2022-31025 affects Discourse versions prior to 2.8.4 on the stable branch and 2.9.0-beta5 on the beta branch.
What type of vulnerability is CVE-2022-31025?
CVE-2022-31025 is a vulnerability that allows user invites to bypass the must_approve_users check in Discourse.
Who is at risk due to CVE-2022-31025?
Sites using Discourse with single sign-on configurations are at risk due to CVE-2022-31025.