PT-2024-33675 · Discourse · Discourse

Pmusaraj · Published 2024-12-19 · Updated 2025-09-26 · CVE-2024-49765

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version

Description: The issue affects sites using Discourse Connect with local logins enabled, potentially allowing attackers to bypass Discourse Connect and create accounts or log in. This problem has been patched in the latest version of Discourse.

Recommendations: For versions prior to the latest version, as a temporary workaround, consider disabling all other login methods except Discourse Connect to minimize the risk of exploitation. Update to the latest version of Discourse to fully resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

BIT-DISCOURSE-2024-49765

CVE-2024-49765

GHSA-V8RF-PVGM-XXF2

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49765.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-v8rf-pvgm-xxf2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49765 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49765 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2024-49765 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1869852416683724823 · Twitter Post
• https://t.me/cveNotify/133395 · Telegram Post
• https://t.me/cveNotify/136526 · Telegram Post
• https://t.me/cvedetector/13366 · Telegram Post
• https://twitter.com/CVEnew/status/1869825995995328593 · Twitter Post