CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event

🗓️ 21 Feb 2024 17:19:11Reported by GoogleType

osv🔗 osv.dev👁 18 Views

Discourse Calendar feature allowing dynamic calendar creation in first post of topic. Uninvited users can access private events by crafting attendance update requests. Issue resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. Workaround: limit access via post visibility.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-26145	21 Feb 202419:22	–	circl
CNNVD	Discourse Security Breach	21 Feb 202400:00	–	cnnvd
CVE	CVE-2024-26145	21 Feb 202417:19	–	cve
Cvelist	CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event	21 Feb 202417:19	–	cvelist
EUVD	EUVD-2024-23428	3 Oct 202520:07	–	euvd
NVD	CVE-2024-26145	21 Feb 202418:15	–	nvd
Prion	Design/Logic Flaw	21 Feb 202418:15	–	prion
Positive Technologies	PT-2024-21299 · Discourse · Discourse Calendar	21 Feb 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-26145	23 May 202509:31	–	redhatcve
Vulnrichment	CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event	21 Feb 202417:19	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26145.json
github	www.github.com/discourse/discourse-calendar/security/advisories/GHSA-4hh7-6m34-p2jp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-26145
github	www.github.com/discourse/discourse-calendar/commit/dfc4fa15f340189f177a1d1ab2cc94ffed3c1190

02 Apr 2026 10:07Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5

EPSS0.00158