CVE-2021-32788

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
discourse	discourse	< 2.7.7

References

https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5Patch, Third Party Advisory
https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92Third Party Advisory
https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5Patch, Third Party Advisory
https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92Third Party Advisory

Timeline

Published: Jul 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327897.5woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCom CVE-2021-32796.1sz.chat version 4 allows injection of web scripts and HTML in the message box.CVE-2021-327904.9Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCo CVE-2021-327915.9mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party,CVE-2021-327926.1mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party,CVE-2021-327934.8Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web int CVE-2021-327947.5ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF cod CVE-2021-327955.9ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.CVE-2021-327965.3xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 CVE-2021-327979.6JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untruste CVE-2021-327989.6The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code CVE-2021-328008.1Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication