What’s Vulnerable › Vulnerabilities

CVE-2022-24782: Secure category names leaked via user activity export in Discourse

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-24 · updated 2026-06-17
• Weakness: CWE-200

Description

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the `main` branch of Discourse's GitHub repository and is anticipated to be part of future releases.

Affected products

• discourse: through 2.8.2

References

• https://github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356
• https://github.com/discourse/discourse/pull/16273
• https://github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343
• https://github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356
• https://github.com/discourse/discourse/pull/16273
• https://github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343

Get alerted when CVE-2022-24782 or the next vulnerability affects your stack