CVE-2024-26145: Uninvited user is able to join and mark the attendance of the the private event
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a workaround, one may use post visibility to limit access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch dfc4fa15f340189f177a1d1ab2cc94ffed3c1190 - Compensating control
Use post visibility on Discourse to limit access to the private event (workaround: restrict visibility of the first post that contains the dynamic calendar).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26145?
CVE-2024-26145 is considered a medium severity vulnerability due to its impact on private event access.
How do I fix CVE-2024-26145?
To address CVE-2024-26145, update the Discourse Calendar plugin to a version released after February 21, 2024.
What type of vulnerability is CVE-2024-26145?
CVE-2024-26145 is a security vulnerability that allows uninvited users to access private events in Discourse.
Who is affected by CVE-2024-26145?
CVE-2024-26145 affects users utilizing the Discourse Calendar plugin prior to the specified fixed version.
What components are impacted by CVE-2024-26145?
The impacted component is the Discourse Calendar plugin within the Discourse platform.