CVE-2021-32788
mediumpriority · track · 17EPSS 0.009 · 59 %ileEUUSEPSS · scored 2026-10-27
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- BIT-discourse-2021-32788Post creator of a whisper post can be revealed to non-staff users in Discourse2024-03-06vendor · osvUS
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5cnnvd
- https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9cnnvd
- https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-32788cnnvd
- https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5enisa_euvd
- https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9enisa_euvd
- https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92enisa_euvd
- https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5PatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan