CVE-2022-36068

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
discourse	discourse	< 2.8.9; >= 2.9.0.beta0, < 2.9.0.beta10

References

https://github.com/discourse/discourse/commit/ae1e536e83940d58f1c79b835c75c249121c46b6Patch, Third Party Advisory
https://github.com/discourse/discourse/pull/18418Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-6crr-3662-263qThird Party Advisory
https://github.com/discourse/discourse/commit/ae1e536e83940d58f1c79b835c75c249121c46b6Patch, Third Party Advisory
https://github.com/discourse/discourse/pull/18418Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-6crr-3662-263qThird Party Advisory

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-360697.3Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses var CVE-2022-36076.0Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.CVE-2022-360707.3Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `g CVE-2022-360718.1SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (T CVE-2022-360725.9SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP,CVE-2022-360738.8RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems CVE-2022-360747.5Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fa CVE-2022-360754.3Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certai CVE-2022-360767.5NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict con CVE-2022-360776.1The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.CVE-2022-360787.5Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited t CVE-2022-360797.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internall