CVE-2021-43792 json
Notifications leak in Discourse
published 2021-12-01 4 y ago modified 2026-09-08 2 mo ago also BIT-discourse-2021-43792 , EUVD-2021-30688 , GHSA-pq2x-vq37-8522
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible.
Patch / fix
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <2.7.11 |
2.7.11 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4
patch, third-party-advisory, advisory
-
meta.discourse.org
/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895
vendor-advisory, advisory
-
github.com
/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-43792
web
Sources
- CVE List CVE-2021-43792
- NVD CVE-2021-43792
- OSV BIT-discourse-2021-43792
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.