Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable
branch and prior to 2.9.0.beta10 on the beta
and tests-passed
branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the stable
branch and version 2.9.0.beta10 on the beta
and tests-passed
branches. There are no known workarounds.
{ "cpes": [ "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta9:*:*:*:*:*:*" ], "severity": "High" }