What’s Vulnerable › Vulnerabilities

CVE-2022-21678: User's bio visible even if profile is restricted in Discourse

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-13 · updated 2026-06-17
• Weakness: CWE-200

Description

Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.

Affected products

• discourse: before 2.7.13; 2.8.0-beta1, 2.8.0-beta10, 2.8.0-beta2, 2.8.0-beta3, 2.8.0-beta4, 2.8.0-beta5 (+4) — fixed in 2.7.13

How to fix

Upgrade to a fixed version: discourse 2.7.13. Check the vendor advisory for mitigations.

References

• https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6de
• https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6c
• https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564m
• https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6de
• https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6c
• https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564m

Get alerted when CVE-2022-21678 or the next vulnerability affects your stack