CVE-2022-24804 — Private group name exposure in discourse
Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with…
Published: 2022-04-11 · CVSS: 5.3 · CVSS 3.1
Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permissions setting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7