CVE-2022-24782

Name of the Vulnerable Software and Affected Versions Discourse versions 2.8.2 and prior in the stable branch Discourse versions 2.9.0.beta3 and prior in the beta branch Discourse versions 2.9.0.beta3 and prior in the tests-passed branch

Description Discourse is an open source discussion platform. Users can request an export of their own activity, which may sometimes include the name of a secure category due to category settings, potentially leading to a data leak. This can occur when a user has category membership for a secure category or when their post has been moved to a secure category.

Recommendations For versions 2.8.2 and prior in the stable branch, update to a version that includes the patch available in the main branch of Discourse's GitHub repository. For versions 2.9.0.beta3 and prior in the beta branch, update to a version that includes the patch available in the main branch of Discourse's GitHub repository. For versions 2.9.0.beta3 and prior in the tests-passed branch, update to a version that includes the patch available in the main branch of Discourse's GitHub repository.