Medium severity · published Nov 2, 2022
CVE-2022-39378
Displaying user badges can leak topic titles to users that have no access to the topic
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any user. If there are sensitive information in the topic title, it will therefore have been exposed. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are currently no known workarounds available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
discourse · discourse
<= 2.8.9; <= 2.9.0.beta10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39378
Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-2gvq-27h6-4h5f
More from discourse
9.9
CVE-2025-68662
FinalDestination hostname matching allows SSRF protection bypass
9.8
CVE-2025-53102
Discourse's WebAuthn challenge isn't cleared from user session after authentication
9.8
CVE-2025-48877
Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe
9.8
CVE-2023-47121
Discourse is an open source platform for community discussion
9.8
CVE-2021-41163
Discourse is an open source platform for community discussion