Jomaxro

Discourse is an open-source discussion platform. An authorization bypass in the poll plugin allowed authenticated users to perform actions on polls they were not authorized to access. This included voting, removing votes, and changing the open/closed status of polls. The issue occurred because the authorization check and poll lookup used different resolutions when the `post id` parameter was passed as an array (e.g., `post id[]=&post id[]=`). This affected the following API endpoints within the `DiscoursePoll::PollsController`: - `/vote` - `/remove vote` - `/toggle status` The `post id` parameter is a vulnerable parameter.

Discourse, an open-source discussion platform, is affected by a potential stored Cross-Site Scripting (XSS) issue in topic titles within the solved posts stream. This allows for the injection of malicious scripts that can be executed in the context of other users' browsers.

Discourse is an open-source discussion platform. Insufficient authorization checks in the `user actions` API endpoint allowed a user to access another user's private activity. The `user actions` endpoint is vulnerable, potentially exposing private user data. The vulnerable parameter is not specified.

Discourse is an open-source discussion platform. The `ComposerController#mentions` API endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying `allowed names` referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether `user reasons` returns "private" for a given user. This bypasses group member-visibility controls.

Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS.

The issue affects users who disable chat in preferences but could still be reachable in some cases. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue allows an attacker to execute arbitrary JavaScript code in users' browsers by posting a maliciously crafted Onebox URL. This problem only affects sites with Content Security Policy (CSP) disabled. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. The technical details about exploitation include the use of a malicious Onebox URL to execute arbitrary JavaScript code.

The issue concerns the Discourse AI plugin, which provides AI features. When sharing conversations from the Discourse AI Bot into posts, HTML entities from the conversation could leak into the Discourse application if a user visits a post with a onebox for that conversation. This problem has been addressed in commit `92f122c`.

Discourse is an open source platform for community discussion. The embedding feature is susceptible to server side request forgery. As a workaround, disable the Embedding feature.

Discourse is an open source community platform. In affected versions, any user can create a topic and add arbitrary custom fields to a topic. The severity of this issue depends on what plugins are installed and how the plugins use topic custom fields. For a default Discourse installation with the default plugins, this issue has no impact.

Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide user profiles from public` is enabled.

Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the "/polls/grouped poll results" endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users.

Discourse is an open-source discussion platform. Importing a remote theme loads their assets into memory without enforcing limits for file size or number of files.

A malicious user can create an unlimited number of drafts with very long draft keys, potentially exhausting server resources.

A malicious user could add a 2FA or security key with a carefully crafted name to their account, causing a denial of service for other users.

A malicious admin could create extremely large icons sprites, which would then be cached in each server process, potentially causing server processes to be killed and leading to downtime. This issue is a concern for multisite installations, but no action is required when admins are trusted.

Discourse is an open source discussion platform. Information about restricted-visibility topic tags could be obtained by unauthorized users.

A malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue affects Discourse, an open source discussion platform. Users of multisite configurations are at risk.

Discourse is an open source discussion platform. A malicious user can edit a post in a topic and cause a Denial of Service (DoS) with a carefully crafted edit reason.

Discourse is an open source discussion platform. The issue allows more users than permitted to be created from invite links. As a workaround, use restrict to email address invites.