Uninvited user is able to join and mark the attendance of the the private event
CVE-2024-26145

4.3MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse-calendar
Vendor
CVE Published:
21 February 2024

What is CVE-2024-26145?

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a workaround, one may use post visibility to limit access.

Affected Version(s)

discourse-calendar >= 2201b254, < dfc4fa15f340189f177a1d1ab2cc94ffed3c1190

References

https://github.com/discourse/discourse-calendar/security/...
x_refsource_CONFIRM
https://github.com/discourse/discourse-calendar/commit/df...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.