Discourse is an open-source discussion platform. Prior to version 2.8.13 of the stable
branch and version 2.9.0.beta14 of the beta
and tests-passed
branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This issue is patched in version 2.8.13 of the stable
branch and version 2.9.0.beta14 of the beta
and tests-passed
branches. As a workaround, use the disable_email
site setting to disable all emails to non-staff users.
{ "cpes": [ "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta13:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2.9.0:beta8:*:*:*:*:*:*" ], "severity": "Medium" }