CVE-2022-36068: Discourse moderators can edit themes via the API
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the stable branch and version 2.9.0.beta10 on the beta and tests-passed branches. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36068?
CVE-2022-36068 is considered a moderate severity vulnerability due to the potential for unauthorized theme modifications in Discourse.
How do I fix CVE-2022-36068?
To fix CVE-2022-36068, upgrade to Discourse version 2.8.9 or later on the stable branch or 2.9.0.beta10 or later on the beta and tests-passed branches.
Who is affected by CVE-2022-36068?
CVE-2022-36068 affects Discourse versions prior to 2.8.9 and beta versions prior to 2.9.0.beta10.
What impact can CVE-2022-36068 have on a Discourse forum?
CVE-2022-36068 allows unauthorized moderators to create or edit themes using the API, which can lead to unwanted changes and potential abuse.
Is there a workaround for CVE-2022-36068 if I can't upgrade?
There is no specific workaround for CVE-2022-36068; the recommended action is to update to the secure versions.