CVE-2022-41944: Discourse users can see notifications for topics they no longer have access to

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-28 · updated 2026-06-17
Weakness: CWE-200

Description

Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain conditions, a user can see notifications for topics they no longer have access to. If there is sensitive information in the topic title, it will therefore have been exposed. This issue is patched in stable version 2.8.12, beta version 2.9.0.beta13, and tests-passed version 2.9.0.beta13. There are no workarounds available.

Affected products

discourse: through 2.8.11; 2.9.0-beta1, 2.9.0-beta10, 2.9.0-beta11, 2.9.0-beta12, 2.9.0-beta2, 2.9.0-beta3 (+6)

References

Get alerted when CVE-2022-41944 or the next vulnerability affects your stack