CVE-2022-21678
Discourse is an open source discussion platform.
Does this matter?
Lower severity and a low EPSS score (0.79%). Track it; it rarely justifies an emergency change on its own.
Description
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.79% probability · 56th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-863
- Affected
- discourse/discourse
- Source
- security-advisories@github.com
EPSS 0.8% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6dePatch, Third Party Advisory
- https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6cPatch, Third Party Advisory
- https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564mPatch, Third Party Advisory
- https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6dePatch, Third Party Advisory
- https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6cPatch, Third Party Advisory
- https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564mPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.