Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-49765

Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.

Published

2024-12-19T20:15:07.143

Last Modified

2025-09-26T12:50:18.810

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-359
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application discourse discourse < 3.3.3 Yes
Application discourse discourse < 3.4.0 Yes
Application discourse discourse 3.4.0 Yes
Application discourse discourse 3.4.0 Yes
Application discourse discourse 3.4.0 Yes
References