CVE-2022-31025

Invite bypasses user approval in Discourse

Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the `stable` branch and version `2.9.0.beta5` on the `beta` and `tests-passed` branches. As a workaround, disable invites or increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.

We have discovered 805 live websites that are affected by CVE-2022-31025.

Contact us to get more info



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains805 live websites (15.41% of Discourse install base)
Vulnerable Versions
  • from 0 before 2.8.4
Vulnerable Versions Count60 versions ( 63.16% of all versions)


Common Weakness Enumeration

CWE-285 Improper Authorization



Details

  • Published - Jun 3, 2022
  • Updated - Aug 3, 2024

CVE-2022-31025 usage by Country

United States539 websites


Germany64 websites
France37 websites
Singapore24 websites
China23 websites
GB17 websites
Brazil8 websites
Netherlands8 websites
Russia8 websites

CVE-2022-31025 usage by TLD

.com346 websites
.org129 websites
.io39 websites
.net32 websites
.de20 websites
.co13 websites
.fr10 websites
.eu8 websites
.com.br8 websites
.ru8 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-31025

Top websites that are affected by CVE-2022-31025. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.***.com France*,***
*********.*******.org United States**,***
******.********.com United States**,***
*********.***************.com United States**,***
*********.**********.io United States***,***
*********.****.ly United States***,***
*************.de United States***,***
*****.***********.com United States***,***
*************.com United States***,***
*********.*********.io United States***,***
See full domain list

FAQ

CVE-2022-31025 is Improper Authorization in Discourse
A total of 805 websites have been identified as vulnerable to CVE-2022-31025, discovered through global website indexing conducted by WebTechSurvey.
Discourse is susceptible to CVE-2022-31025 vulnerability.
Discourse versions before 2.8.4 are vulnerable to CVE-2022-31025.
Version 2.8.4 of Discourse addresses the CVE-2022-31025 security vulnerability.