CVE-2024-49765

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version

Description: The issue affects sites using Discourse Connect with local logins enabled, potentially allowing attackers to bypass Discourse Connect and create accounts or log in. This problem has been patched in the latest version of Discourse.

Recommendations: For versions prior to the latest version, as a temporary workaround, consider disabling all other login methods except Discourse Connect to minimize the risk of exploitation. Update to the latest version of Discourse to fully resolve the issue.