PT-2022-20469 · Discourse · Discourse

Lowjomaxro · Published 2022-06-03 · Updated 2025-10-14 · CVE-2022-31025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.4 on the stable branch Discourse versions prior to 2.9.0beta5 on the beta and tests-passed branches

Description The issue affects Discourse, an open source platform for community discussion. Inviting users on sites that use single sign-on could bypass the must approve users check, and invites by staff are always approved automatically.

Recommendations For versions prior to 2.8.4 on the stable branch, update to version 2.8.4 or later. For versions prior to 2.9.0beta5 on the beta and tests-passed branches, update to version 2.9.0beta5 or later. As a temporary workaround, consider disabling invites or increase min trust level to allow invite to reduce the attack surface to more trusted users.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-DISCOURSE-2022-31025

CVE-2022-31025

GHSA-X7JH-MX5Q-6F9Q

Affected Products

Discourse

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31025.json · Exploit
• https://github.com/discourse/discourse/commit/7c4e2d33fa4b922354c177ffc880a2f2701a91f9 · Patch
• https://github.com/discourse/discourse/commit/0fa0094531efc82d9371f90a02aa804b176d59cf · Patch
• https://github.com/discourse/discourse/pull/16984 · Patch
• https://github.com/discourse/discourse/pull/16974 · Patch
• https://osv.dev/vulnerability/CVE-2022-31025 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2022-31025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31025 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-x7jh-mx5q-6f9q · Note
• https://twitter.com/Cezar_H_Linux/status/1978136518234431648 · Twitter Post
• https://t.me/cibsecurity/43925 · Telegram Post