CVE-2021-32788

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.

• CWE-668
• CWE-668

• https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5Patch, Third Party Advisory
• https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92Third Party Advisory
• https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5Patch, Third Party Advisory
• https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92Third Party Advisory

Published

Jul 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32781Envoy is an open source L7 proxy and communication bus desig…7.5
• CVE-2021-32782Nextcloud Circles is an open source social network built for…5.4
• CVE-2021-32783Contour is a Kubernetes ingress controller using Envoy proxy…8.5
• CVE-2021-32785mod_auth_openidc is an authentication/authorization module f…7.5
• CVE-2021-32786mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-32787Sourcegraph is a code search and navigation engine. Sourcegr…4.3
• CVE-2021-32789woocommerce-gutenberg-products-block is a feature plugin for…7.5
• CVE-2021-3279sz.chat version 4 allows injection of web scripts and HTML i…6.1
• CVE-2021-32790Woocommerce is an open source eCommerce plugin for WordPress…4.9
• CVE-2021-32791mod_auth_openidc is an authentication/authorization module f…5.9
• CVE-2021-32792mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-32793Pi-hole's Web interface provides a central location to manag…4.8