7.5
CWE
770
Advisory Published
Updated

CVE-2022-31184: Email activation route can be abused by spammers in Discourse

First published: Mon Aug 01 2022(Updated: )

Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email.

Credit: security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Discourse<=2.8.6
Discourse=2.9.0-beta1
Discourse=2.9.0-beta2
Discourse=2.9.0-beta3
Discourse=2.9.0-beta4
Discourse=2.9.0-beta5
Discourse=2.9.0-beta6
Discourse=2.9.0-beta7

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2022-31184?

    CVE-2022-31184 is classified as a moderate severity vulnerability due to its potential for abuse in sending mass spam emails.

  • How do I fix CVE-2022-31184?

    To fix CVE-2022-31184, users should upgrade to the latest stable, beta, or tests-passed versions of Discourse that include the rate limiting for emails.

  • Which versions of Discourse are affected by CVE-2022-31184?

    CVE-2022-31184 affects Discourse versions up to 2.8.6 and certain beta versions up to 2.9.0-beta7.

  • What vulnerability does CVE-2022-31184 address in Discourse?

    CVE-2022-31184 addresses a vulnerability that allows an email activation route to be abused for sending mass spam emails.

  • Is there a patch for CVE-2022-31184?

    Yes, a patch has been included in the latest updates for Discourse that provides rate limiting functionality for email activations.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203