CVE-2024-52589

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.

CVSS v3 2.2 LOW

2.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.7 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:3.4.0:beta1:::beta:::*
	cpe:2.3:a:discourse:discourse:3.4.0:beta2:::beta:::*

History

26 Aug 2025, 02:16

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
First Time		Discourse Discourse discourse
Summary		(es) Discourse es una plataforma de código abierto para debates comunitarios. Los moderadores pueden ver la lista de correos electrónicos filtrados en el panel de administración y, a través de ella, pueden conocer el correo electrónico de un usuario. Este problema se solucionó en la última versión de Discourse. Los usuarios que no puedan actualizar deben eliminar el rol de moderador de los usuarios que no sean de confianza.
CPE		cpe:2.3:a:discourse:discourse:3.4.0:beta1:::beta:::* cpe:2.3:a:discourse:discourse:3.4.0:beta2:::beta:::* cpe:2.3:a:discourse:discourse:::::stable:::* cpe:2.3:a:discourse:discourse:::::beta:::*
References	~~() https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff -~~	() https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff - Vendor Advisory

19 Dec 2024, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-19 20:15

Updated : 2025-08-26 02:16

NVD link : CVE-2024-52589

Mitre link : CVE-2024-52589

CVE.ORG link : CVE-2024-52589

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2024-52589", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2024-12-19T20:15:07.337", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users."}, {"lang": "es", "value": "Discourse es una plataforma de c\u00f3digo abierto para debates comunitarios. Los moderadores pueden ver la lista de correos electr\u00f3nicos filtrados en el panel de administraci\u00f3n y, a trav\u00e9s de ella, pueden conocer el correo electr\u00f3nico de un usuario. Este problema se solucion\u00f3 en la \u00faltima versi\u00f3n de Discourse. Los usuarios que no puedan actualizar deben eliminar el rol de moderador de los usuarios que no sean de confianza."}], "lastModified": "2025-08-26T02:16:43.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "033D6E30-2A4D-43D4-9178-0BA5A7C501B0", "versionEndExcluding": "3.3.3"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "B70F4653-EB23-49AB-AF71-C39E5B6D5E5F", "versionEndExcluding": "3.4.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "AF6D8860-8764-4EEF-9FDD-89FF932791A7"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "6A7FC47A-8C19-4E39-B0CF-ADA835A02A9B"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}