Exposure of Private Information ('Privacy Violation') in Discourse - CVE-2024-49765
Published: December 19, 2024 / Updated: July 1, 2026
Vulnerability identifier: #VU136103
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-49765
CWE-ID: CWE-359
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose private personal information.
The vulnerability exists due to improper access control in other enabled login paths when discourse connect is enabled alongside local logins. A remote attacker can create an account or log in through an alternate login path to disclose private personal information.
Only sites that use discourse connect while also keeping other login methods enabled are vulnerable.
Affected software
Discourse
How to mitigate CVE-2024-49765
Install security update from vendor's website.
Discourse - addressed in versions 3.3.3, 3.4.0 beta4