Discourse password reset link can lead to in account takeover if user changes to a new email

CVE-2022-46177

Summary

The Discourse platform contains a security flaw where a user can request a password reset link while changing their primary email address. If the user utilizes the old email for resetting their password, this could lead to a scenario where their account is re-linked to the old email, making it vulnerable to an account takeover if that old email is compromised. This issue affects versions prior to 2.8.14 on the stable branch and 3.0.0.beta16 on beta branches. Users are advised to upgrade to secure versions to mitigate this risk, or alternatively, reduce the email_token_valid_hours setting, currently set to 48 hours, as a temporary workaround.

References