PT-2024-33675

CVE-2024-49765

·

Published

2024-12-19

·

Updated

2025-09-26

Description by

CVSS 3.1
9.1
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version
Description: The issue affects sites using Discourse Connect with local logins enabled, potentially allowing attackers to bypass Discourse Connect and create accounts or log in. This problem has been patched in the latest version of Discourse.
Recommendations: For versions prior to the latest version, as a temporary workaround, consider disabling all other login methods except Discourse Connect to minimize the risk of exploitation. Update to the latest version of Discourse to fully resolve the issue.
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Related identifiers
CVE-2024-49765
GHSA-V8RF-PVGM-XXF2
BIT-DISCOURSE-2024-49765
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com