CVE-2021-41082 Private message title and participating users leaked in discourse

High 7.5 Published 20 Sep 2021 Updated 4 Aug 2024

Attackers can view titles and participants of private messages involving groups, leaking metadata without accessing message content.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-41082?

CVE-2021-41082 is a high-severity vulnerability in Discourse Discourse, published on 20 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.

Weakness: CWE-863, CWE-200

Which versions are affected by CVE-2021-41082?

It affects 1 product.

Products include Discourse Discourse.

How do I fix CVE-2021-41082?

No fix has been published for CVE-2021-41082 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-41082 being exploited?

There is no known exploitation of CVE-2021-41082 in the wild and no public exploit code.

All Discourse Discourse vulnerabilities

Sources

Also known as GHSA-vm3x-w6jm-j9vv.