CVE-2026-45780

Katalog CVE

CVSS 4.3 · Medium EPSS 0,50%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-22v7-6wgj-g9f7 advisory vendor
• https://github.com/discourse/discourse/commit/37969503f20369eb1712b7b88daedcfb4f63f5f1 patch
• https://github.com/discourse/discourse/commit/4d46638041b5f3d1e1f7f6f6f19c1df3bd65a586 patch
• https://github.com/discourse/discourse/commit/6457ab71f36a2d1440fe96af0a2593897844b023 patch
• https://github.com/discourse/discourse/commit/7deb4b6963442569357b41e61febe37594e5e730 patch
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 release notes