CVE-2022-21684

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with `must_approve_users` enabled is going to be automatically logged in, bypassing the check that does not allow unapproved users to sign in. They will be able to do everything an approved user can do. If they logout, they cannot log back in. This issue is patched in the `stable` version 2.7.13, `beta` version 2.8.0.beta11, and `tests-passed` version 2.8.0.beta11. One may disable invites as a workaround. Administrators can increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-216856.5Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier'sCVE-2022-216869.8PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to injeCVE-2022-216876.5gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerabilCVE-2022-216885.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216897.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-21694.8The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admiCVE-2022-216905.4OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216914.3OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216924.3OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216936.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216945.3OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216955.3OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor net
CVE-2022-21684: High severity, CVSS 8.8 | Vulnix