Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Discourse | Discourse | * | 3.4.3 (excluding) |
| Discourse | Discourse | 1.1.0-beta1 (including) | 1.1.0-beta1 (including) |
| Discourse | Discourse | 1.1.0-beta2 (including) | 1.1.0-beta2 (including) |
| Discourse | Discourse | 1.1.0-beta3 (including) | 1.1.0-beta3 (including) |
| Discourse | Discourse | 1.1.0-beta4 (including) | 1.1.0-beta4 (including) |
| Discourse | Discourse | 1.1.0-beta5 (including) | 1.1.0-beta5 (including) |
| Discourse | Discourse | 1.1.0-beta6 (including) | 1.1.0-beta6 (including) |
| Discourse | Discourse | 1.1.0-beta6b (including) | 1.1.0-beta6b (including) |
| Discourse | Discourse | 1.1.0-beta7 (including) | 1.1.0-beta7 (including) |
| Discourse | Discourse | 1.1.0-beta8 (including) | 1.1.0-beta8 (including) |
| Discourse | Discourse | 1.2.0-beta1 (including) | 1.2.0-beta1 (including) |
| Discourse | Discourse | 1.2.0-beta2 (including) | 1.2.0-beta2 (including) |
| Discourse | Discourse | 1.2.0-beta3 (including) | 1.2.0-beta3 (including) |
| Discourse | Discourse | 1.2.0-beta4 (including) | 1.2.0-beta4 (including) |
| Discourse | Discourse | 1.2.0-beta5 (including) | 1.2.0-beta5 (including) |
| Discourse | Discourse | 1.2.0-beta6 (including) | 1.2.0-beta6 (including) |
| Discourse | Discourse | 1.2.0-beta7 (including) | 1.2.0-beta7 (including) |
| Discourse | Discourse | 1.2.0-beta8 (including) | 1.2.0-beta8 (including) |
| Discourse | Discourse | 1.2.0-beta9 (including) | 1.2.0-beta9 (including) |
| Discourse | Discourse | 1.3.0-beta1 (including) | 1.3.0-beta1 (including) |
| Discourse | Discourse | 1.3.0-beta10 (including) | 1.3.0-beta10 (including) |
| Discourse | Discourse | 1.3.0-beta11 (including) | 1.3.0-beta11 (including) |
| Discourse | Discourse | 1.3.0-beta2 (including) | 1.3.0-beta2 (including) |
| Discourse | Discourse | 1.3.0-beta3 (including) | 1.3.0-beta3 (including) |
| Discourse | Discourse | 1.3.0-beta4 (including) | 1.3.0-beta4 (including) |
| Discourse | Discourse | 1.3.0-beta5 (including) | 1.3.0-beta5 (including) |
| Discourse | Discourse | 1.3.0-beta6 (including) | 1.3.0-beta6 (including) |
| Discourse | Discourse | 1.3.0-beta7 (including) | 1.3.0-beta7 (including) |
| Discourse | Discourse | 1.3.0-beta8 (including) | 1.3.0-beta8 (including) |
| Discourse | Discourse | 1.3.0-beta9 (including) | 1.3.0-beta9 (including) |
| Discourse | Discourse | 1.4.0-beta1 (including) | 1.4.0-beta1 (including) |
| Discourse | Discourse | 1.4.0-beta10 (including) | 1.4.0-beta10 (including) |
| Discourse | Discourse | 1.4.0-beta11 (including) | 1.4.0-beta11 (including) |
| Discourse | Discourse | 1.4.0-beta12 (including) | 1.4.0-beta12 (including) |
| Discourse | Discourse | 1.4.0-beta2 (including) | 1.4.0-beta2 (including) |
| Discourse | Discourse | 1.4.0-beta3 (including) | 1.4.0-beta3 (including) |
| Discourse | Discourse | 1.4.0-beta4 (including) | 1.4.0-beta4 (including) |
| Discourse | Discourse | 1.4.0-beta5 (including) | 1.4.0-beta5 (including) |
| Discourse | Discourse | 1.4.0-beta6 (including) | 1.4.0-beta6 (including) |
| Discourse | Discourse | 1.4.0-beta7 (including) | 1.4.0-beta7 (including) |
| Discourse | Discourse | 1.4.0-beta8 (including) | 1.4.0-beta8 (including) |
| Discourse | Discourse | 1.4.0-beta9 (including) | 1.4.0-beta9 (including) |
| Discourse | Discourse | 1.5.0-beta1 (including) | 1.5.0-beta1 (including) |
| Discourse | Discourse | 1.5.0-beta10 (including) | 1.5.0-beta10 (including) |
| Discourse | Discourse | 1.5.0-beta11 (including) | 1.5.0-beta11 (including) |
| Discourse | Discourse | 1.5.0-beta12 (including) | 1.5.0-beta12 (including) |
| Discourse | Discourse | 1.5.0-beta13 (including) | 1.5.0-beta13 (including) |
| Discourse | Discourse | 1.5.0-beta13b (including) | 1.5.0-beta13b (including) |
| Discourse | Discourse | 1.5.0-beta14 (including) | 1.5.0-beta14 (including) |
| Discourse | Discourse | 1.5.0-beta2 (including) | 1.5.0-beta2 (including) |
| Discourse | Discourse | 1.5.0-beta3 (including) | 1.5.0-beta3 (including) |
| Discourse | Discourse | 1.5.0-beta4 (including) | 1.5.0-beta4 (including) |
| Discourse | Discourse | 1.5.0-beta5 (including) | 1.5.0-beta5 (including) |
| Discourse | Discourse | 1.5.0-beta6 (including) | 1.5.0-beta6 (including) |
| Discourse | Discourse | 1.5.0-beta7 (including) | 1.5.0-beta7 (including) |
| Discourse | Discourse | 1.5.0-beta8 (including) | 1.5.0-beta8 (including) |
| Discourse | Discourse | 1.5.0-beta9 (including) | 1.5.0-beta9 (including) |
| Discourse | Discourse | 1.6.0-beta1 (including) | 1.6.0-beta1 (including) |
| Discourse | Discourse | 1.6.0-beta10 (including) | 1.6.0-beta10 (including) |
| Discourse | Discourse | 1.6.0-beta11 (including) | 1.6.0-beta11 (including) |
| Discourse | Discourse | 1.6.0-beta12 (including) | 1.6.0-beta12 (including) |
| Discourse | Discourse | 1.6.0-beta2 (including) | 1.6.0-beta2 (including) |
| Discourse | Discourse | 1.6.0-beta3 (including) | 1.6.0-beta3 (including) |
| Discourse | Discourse | 1.6.0-beta4 (including) | 1.6.0-beta4 (including) |
| Discourse | Discourse | 1.6.0-beta5 (including) | 1.6.0-beta5 (including) |
| Discourse | Discourse | 1.6.0-beta6 (including) | 1.6.0-beta6 (including) |
| Discourse | Discourse | 1.6.0-beta7 (including) | 1.6.0-beta7 (including) |
| Discourse | Discourse | 1.6.0-beta8 (including) | 1.6.0-beta8 (including) |
| Discourse | Discourse | 1.6.0-beta9 (including) | 1.6.0-beta9 (including) |
| Discourse | Discourse | 1.7.0-beta1 (including) | 1.7.0-beta1 (including) |
| Discourse | Discourse | 1.7.0-beta10 (including) | 1.7.0-beta10 (including) |
| Discourse | Discourse | 1.7.0-beta11 (including) | 1.7.0-beta11 (including) |
| Discourse | Discourse | 1.7.0-beta2 (including) | 1.7.0-beta2 (including) |
| Discourse | Discourse | 1.7.0-beta3 (including) | 1.7.0-beta3 (including) |
| Discourse | Discourse | 1.7.0-beta4 (including) | 1.7.0-beta4 (including) |
| Discourse | Discourse | 1.7.0-beta5 (including) | 1.7.0-beta5 (including) |
| Discourse | Discourse | 1.7.0-beta6 (including) | 1.7.0-beta6 (including) |
| Discourse | Discourse | 1.7.0-beta7 (including) | 1.7.0-beta7 (including) |
| Discourse | Discourse | 1.7.0-beta8 (including) | 1.7.0-beta8 (including) |
| Discourse | Discourse | 1.7.0-beta9 (including) | 1.7.0-beta9 (including) |
| Discourse | Discourse | 1.8.0-beta1 (including) | 1.8.0-beta1 (including) |
| Discourse | Discourse | 1.8.0-beta10 (including) | 1.8.0-beta10 (including) |
| Discourse | Discourse | 1.8.0-beta11 (including) | 1.8.0-beta11 (including) |
| Discourse | Discourse | 1.8.0-beta12 (including) | 1.8.0-beta12 (including) |
| Discourse | Discourse | 1.8.0-beta13 (including) | 1.8.0-beta13 (including) |
| Discourse | Discourse | 1.8.0-beta2 (including) | 1.8.0-beta2 (including) |
| Discourse | Discourse | 1.8.0-beta3 (including) | 1.8.0-beta3 (including) |
| Discourse | Discourse | 1.8.0-beta4 (including) | 1.8.0-beta4 (including) |
| Discourse | Discourse | 1.8.0-beta5 (including) | 1.8.0-beta5 (including) |
| Discourse | Discourse | 1.8.0-beta6 (including) | 1.8.0-beta6 (including) |
| Discourse | Discourse | 1.8.0-beta7 (including) | 1.8.0-beta7 (including) |
| Discourse | Discourse | 1.8.0-beta8 (including) | 1.8.0-beta8 (including) |
| Discourse | Discourse | 1.8.0-beta9 (including) | 1.8.0-beta9 (including) |
| Discourse | Discourse | 1.9.0-beta1 (including) | 1.9.0-beta1 (including) |
| Discourse | Discourse | 1.9.0-beta10 (including) | 1.9.0-beta10 (including) |
| Discourse | Discourse | 1.9.0-beta11 (including) | 1.9.0-beta11 (including) |
| Discourse | Discourse | 1.9.0-beta12 (including) | 1.9.0-beta12 (including) |
| Discourse | Discourse | 1.9.0-beta13 (including) | 1.9.0-beta13 (including) |
| Discourse | Discourse | 1.9.0-beta14 (including) | 1.9.0-beta14 (including) |
| Discourse | Discourse | 1.9.0-beta15 (including) | 1.9.0-beta15 (including) |
| Discourse | Discourse | 1.9.0-beta16 (including) | 1.9.0-beta16 (including) |
| Discourse | Discourse | 1.9.0-beta17 (including) | 1.9.0-beta17 (including) |
| Discourse | Discourse | 1.9.0-beta2 (including) | 1.9.0-beta2 (including) |
| Discourse | Discourse | 1.9.0-beta3 (including) | 1.9.0-beta3 (including) |
| Discourse | Discourse | 1.9.0-beta4 (including) | 1.9.0-beta4 (including) |
| Discourse | Discourse | 1.9.0-beta5 (including) | 1.9.0-beta5 (including) |
| Discourse | Discourse | 1.9.0-beta6 (including) | 1.9.0-beta6 (including) |
| Discourse | Discourse | 1.9.0-beta7 (including) | 1.9.0-beta7 (including) |
| Discourse | Discourse | 1.9.0-beta8 (including) | 1.9.0-beta8 (including) |
| Discourse | Discourse | 1.9.0-beta9 (including) | 1.9.0-beta9 (including) |
| Discourse | Discourse | 2.0.0-beta1 (including) | 2.0.0-beta1 (including) |
| Discourse | Discourse | 2.0.0-beta10 (including) | 2.0.0-beta10 (including) |
| Discourse | Discourse | 2.0.0-beta2 (including) | 2.0.0-beta2 (including) |
| Discourse | Discourse | 2.0.0-beta3 (including) | 2.0.0-beta3 (including) |
| Discourse | Discourse | 2.0.0-beta4 (including) | 2.0.0-beta4 (including) |
| Discourse | Discourse | 2.0.0-beta5 (including) | 2.0.0-beta5 (including) |
| Discourse | Discourse | 2.0.0-beta6 (including) | 2.0.0-beta6 (including) |
| Discourse | Discourse | 2.0.0-beta7 (including) | 2.0.0-beta7 (including) |
| Discourse | Discourse | 2.0.0-beta8 (including) | 2.0.0-beta8 (including) |
| Discourse | Discourse | 2.0.0-beta9 (including) | 2.0.0-beta9 (including) |
| Discourse | Discourse | 2.1.0-beta1 (including) | 2.1.0-beta1 (including) |
| Discourse | Discourse | 2.1.0-beta2 (including) | 2.1.0-beta2 (including) |
| Discourse | Discourse | 2.1.0-beta3 (including) | 2.1.0-beta3 (including) |
| Discourse | Discourse | 2.1.0-beta4 (including) | 2.1.0-beta4 (including) |
| Discourse | Discourse | 2.1.0-beta5 (including) | 2.1.0-beta5 (including) |
| Discourse | Discourse | 2.1.0-beta6 (including) | 2.1.0-beta6 (including) |
| Discourse | Discourse | 2.2.0-beta1 (including) | 2.2.0-beta1 (including) |
| Discourse | Discourse | 2.2.0-beta10 (including) | 2.2.0-beta10 (including) |
| Discourse | Discourse | 2.2.0-beta2 (including) | 2.2.0-beta2 (including) |
| Discourse | Discourse | 2.2.0-beta3 (including) | 2.2.0-beta3 (including) |
| Discourse | Discourse | 2.2.0-beta4 (including) | 2.2.0-beta4 (including) |
| Discourse | Discourse | 2.2.0-beta5 (including) | 2.2.0-beta5 (including) |
| Discourse | Discourse | 2.2.0-beta6 (including) | 2.2.0-beta6 (including) |
| Discourse | Discourse | 2.2.0-beta7 (including) | 2.2.0-beta7 (including) |
| Discourse | Discourse | 2.2.0-beta8 (including) | 2.2.0-beta8 (including) |
| Discourse | Discourse | 2.2.0-beta9 (including) | 2.2.0-beta9 (including) |
| Discourse | Discourse | 2.3.0-beta1 (including) | 2.3.0-beta1 (including) |
| Discourse | Discourse | 2.3.0-beta10 (including) | 2.3.0-beta10 (including) |
| Discourse | Discourse | 2.3.0-beta11 (including) | 2.3.0-beta11 (including) |
| Discourse | Discourse | 2.3.0-beta2 (including) | 2.3.0-beta2 (including) |
| Discourse | Discourse | 2.3.0-beta3 (including) | 2.3.0-beta3 (including) |
| Discourse | Discourse | 2.3.0-beta4 (including) | 2.3.0-beta4 (including) |
| Discourse | Discourse | 2.3.0-beta5 (including) | 2.3.0-beta5 (including) |
| Discourse | Discourse | 2.3.0-beta6 (including) | 2.3.0-beta6 (including) |
| Discourse | Discourse | 2.3.0-beta7 (including) | 2.3.0-beta7 (including) |
| Discourse | Discourse | 2.3.0-beta8 (including) | 2.3.0-beta8 (including) |
| Discourse | Discourse | 2.3.0-beta9 (including) | 2.3.0-beta9 (including) |
| Discourse | Discourse | 2.4.0-beta1 (including) | 2.4.0-beta1 (including) |
| Discourse | Discourse | 2.4.0-beta10 (including) | 2.4.0-beta10 (including) |
| Discourse | Discourse | 2.4.0-beta11 (including) | 2.4.0-beta11 (including) |
| Discourse | Discourse | 2.4.0-beta2 (including) | 2.4.0-beta2 (including) |
| Discourse | Discourse | 2.4.0-beta3 (including) | 2.4.0-beta3 (including) |
| Discourse | Discourse | 2.4.0-beta4 (including) | 2.4.0-beta4 (including) |
| Discourse | Discourse | 2.4.0-beta5 (including) | 2.4.0-beta5 (including) |
| Discourse | Discourse | 2.4.0-beta6 (including) | 2.4.0-beta6 (including) |
| Discourse | Discourse | 2.4.0-beta7 (including) | 2.4.0-beta7 (including) |
| Discourse | Discourse | 2.4.0-beta8 (including) | 2.4.0-beta8 (including) |
| Discourse | Discourse | 2.4.0-beta9 (including) | 2.4.0-beta9 (including) |
| Discourse | Discourse | 2.5.0-beta1 (including) | 2.5.0-beta1 (including) |
| Discourse | Discourse | 2.5.0-beta2 (including) | 2.5.0-beta2 (including) |
| Discourse | Discourse | 2.5.0-beta3 (including) | 2.5.0-beta3 (including) |
| Discourse | Discourse | 2.5.0-beta4 (including) | 2.5.0-beta4 (including) |
| Discourse | Discourse | 2.5.0-beta5 (including) | 2.5.0-beta5 (including) |
| Discourse | Discourse | 2.5.0-beta6 (including) | 2.5.0-beta6 (including) |
| Discourse | Discourse | 2.5.0-beta7 (including) | 2.5.0-beta7 (including) |
| Discourse | Discourse | 2.6.0-beta1 (including) | 2.6.0-beta1 (including) |
| Discourse | Discourse | 2.6.0-beta2 (including) | 2.6.0-beta2 (including) |
| Discourse | Discourse | 2.6.0-beta3 (including) | 2.6.0-beta3 (including) |
| Discourse | Discourse | 2.6.0-beta4 (including) | 2.6.0-beta4 (including) |
| Discourse | Discourse | 2.6.0-beta5 (including) | 2.6.0-beta5 (including) |
| Discourse | Discourse | 2.6.0-beta6 (including) | 2.6.0-beta6 (including) |
| Discourse | Discourse | 2.7.0-beta1 (including) | 2.7.0-beta1 (including) |
| Discourse | Discourse | 2.7.0-beta2 (including) | 2.7.0-beta2 (including) |
| Discourse | Discourse | 2.7.0-beta3 (including) | 2.7.0-beta3 (including) |
| Discourse | Discourse | 2.7.0-beta4 (including) | 2.7.0-beta4 (including) |
| Discourse | Discourse | 2.7.0-beta5 (including) | 2.7.0-beta5 (including) |
| Discourse | Discourse | 2.7.0-beta6 (including) | 2.7.0-beta6 (including) |
| Discourse | Discourse | 2.7.0-beta7 (including) | 2.7.0-beta7 (including) |
| Discourse | Discourse | 2.7.0-beta8 (including) | 2.7.0-beta8 (including) |
| Discourse | Discourse | 2.7.0-beta9 (including) | 2.7.0-beta9 (including) |
| Discourse | Discourse | 2.8.0-beta1 (including) | 2.8.0-beta1 (including) |
| Discourse | Discourse | 2.8.0-beta10 (including) | 2.8.0-beta10 (including) |
| Discourse | Discourse | 2.8.0-beta11 (including) | 2.8.0-beta11 (including) |
| Discourse | Discourse | 2.8.0-beta2 (including) | 2.8.0-beta2 (including) |
| Discourse | Discourse | 2.8.0-beta3 (including) | 2.8.0-beta3 (including) |
| Discourse | Discourse | 2.8.0-beta4 (including) | 2.8.0-beta4 (including) |
| Discourse | Discourse | 2.8.0-beta5 (including) | 2.8.0-beta5 (including) |
| Discourse | Discourse | 2.8.0-beta6 (including) | 2.8.0-beta6 (including) |
| Discourse | Discourse | 2.8.0-beta7 (including) | 2.8.0-beta7 (including) |
| Discourse | Discourse | 2.8.0-beta8 (including) | 2.8.0-beta8 (including) |
| Discourse | Discourse | 2.8.0-beta9 (including) | 2.8.0-beta9 (including) |
| Discourse | Discourse | 2.9.0-beta1 (including) | 2.9.0-beta1 (including) |
| Discourse | Discourse | 2.9.0-beta10 (including) | 2.9.0-beta10 (including) |
| Discourse | Discourse | 2.9.0-beta11 (including) | 2.9.0-beta11 (including) |
| Discourse | Discourse | 2.9.0-beta12 (including) | 2.9.0-beta12 (including) |
| Discourse | Discourse | 2.9.0-beta13 (including) | 2.9.0-beta13 (including) |
| Discourse | Discourse | 2.9.0-beta14 (including) | 2.9.0-beta14 (including) |
| Discourse | Discourse | 2.9.0-beta2 (including) | 2.9.0-beta2 (including) |
| Discourse | Discourse | 2.9.0-beta3 (including) | 2.9.0-beta3 (including) |
| Discourse | Discourse | 2.9.0-beta4 (including) | 2.9.0-beta4 (including) |
| Discourse | Discourse | 2.9.0-beta5 (including) | 2.9.0-beta5 (including) |
| Discourse | Discourse | 2.9.0-beta6 (including) | 2.9.0-beta6 (including) |
| Discourse | Discourse | 2.9.0-beta7 (including) | 2.9.0-beta7 (including) |
| Discourse | Discourse | 2.9.0-beta8 (including) | 2.9.0-beta8 (including) |
| Discourse | Discourse | 2.9.0-beta9 (including) | 2.9.0-beta9 (including) |
| Discourse | Discourse | 3.0.0-beta15 (including) | 3.0.0-beta15 (including) |
| Discourse | Discourse | 3.0.0-beta16 (including) | 3.0.0-beta16 (including) |
| Discourse | Discourse | 3.1.0-beta1 (including) | 3.1.0-beta1 (including) |
| Discourse | Discourse | 3.1.0-beta2 (including) | 3.1.0-beta2 (including) |
| Discourse | Discourse | 3.1.0-beta3 (including) | 3.1.0-beta3 (including) |
| Discourse | Discourse | 3.1.0-beta4 (including) | 3.1.0-beta4 (including) |
| Discourse | Discourse | 3.1.0-beta5 (including) | 3.1.0-beta5 (including) |
| Discourse | Discourse | 3.1.0-beta6 (including) | 3.1.0-beta6 (including) |
| Discourse | Discourse | 3.1.0-beta7 (including) | 3.1.0-beta7 (including) |
| Discourse | Discourse | 3.1.0-beta8 (including) | 3.1.0-beta8 (including) |
| Discourse | Discourse | 3.2.0 (including) | 3.2.0 (including) |
| Discourse | Discourse | 3.2.0-beta1 (including) | 3.2.0-beta1 (including) |
| Discourse | Discourse | 3.2.0-beta2 (including) | 3.2.0-beta2 (including) |
| Discourse | Discourse | 3.2.0-beta3 (including) | 3.2.0-beta3 (including) |
| Discourse | Discourse | 3.2.0-beta4 (including) | 3.2.0-beta4 (including) |
| Discourse | Discourse | 3.3.0-beta1 (including) | 3.3.0-beta1 (including) |
| Discourse | Discourse | 3.3.0-beta2 (including) | 3.3.0-beta2 (including) |
| Discourse | Discourse | 3.3.0-beta3 (including) | 3.3.0-beta3 (including) |
| Discourse | Discourse | 3.3.0-beta4 (including) | 3.3.0-beta4 (including) |
| Discourse | Discourse | 3.3.0-beta5 (including) | 3.3.0-beta5 (including) |
| Discourse | Discourse | 3.3.0-beta6 (including) | 3.3.0-beta6 (including) |
| Discourse | Discourse | 3.4.0-beta1 (including) | 3.4.0-beta1 (including) |
| Discourse | Discourse | 3.4.0-beta2 (including) | 3.4.0-beta2 (including) |
| Discourse | Discourse | 3.4.0-beta3 (including) | 3.4.0-beta3 (including) |
| Discourse | Discourse | 3.4.0-beta4 (including) | 3.4.0-beta4 (including) |
| Discourse | Discourse | 3.5.0-beta1 (including) | 3.5.0-beta1 (including) |
| Discourse | Discourse | 3.5.0-beta2 (including) | 3.5.0-beta2 (including) |
Access control involves the use of several protection mechanisms such as:
When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: