CVE-2022-31025

Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the stable branch and 2.9.0beta5 on the beta and tests-passed branches, inviting users on sites that use single sign-on could bypass the mustapproveusers check and invites by staff are always approved...

CVE-2022-31025 Invite bypasses user approval in Discourse

Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the stable branch and 2.9.0beta5 on the beta and tests-passed branches, inviting users on sites that use single sign-on could bypass the mustapproveusers check and invites by staff are always approved...

CVE-2022-21684

Discourse (open source platform) contains a login-bypass vulnerability for invited users when must_approve_users is enabled. Affected versions: prior to 2.7.13 (stable) and 2.8.0.beta11 (beta/tests-passed) allow invited users to log in automatically and perform actions of approved users; after lo...