Improper access control in Discourse - CVE-2022-21684
Published: January 13, 2022 / Updated: July 1, 2026
Vulnerability identifier: #VU136503
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2022-21684
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Civilized Discourse Construction Kit, Inc.
Affected software:
Discourse
Discourse
Detailed vulnerability description
The vulnerability allows a remote user to bypass user approval and access the forum with the permissions of an approved user.
The vulnerability exists due to improper access control in the invite redemption flow when redeeming an email invitation on forums with user approval required. A remote user can redeem a valid invitation to bypass user approval and access the forum with the permissions of an approved user.
Only users invited via email are affected, and the access is limited to the initial automatic login session.
How to mitigate CVE-2022-21684
Install security update from vendor's website.