CVE-2021-41082

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-410838.8Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via CVE-2021-410844.7http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting atta CVE-2021-410865.4jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scri CVE-2021-410876.5in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticate CVE-2021-410888.8Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (star CVE-2021-410896.3Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempti CVE-2021-410907.5Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to ve CVE-2021-410916.3Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data CVE-2021-410927.5Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-CVE-2021-410939.8Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an ac CVE-2021-410944.6Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their CVE-2021-410956.1Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `s