CVE-2021-41082

Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.

• CWE-200
• CWE-863

• https://github.com/discourse/discourse/commit/27bad28c530c89acab35a56b945b6a3924280f4bPatch, Third Party Advisory
• https://github.com/discourse/discourse/commit/ddb458343dc39a7a8c99467dcd809b444514fe2cPatch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-vm3x-w6jm-j9vvThird Party Advisory
• https://github.com/discourse/discourse/commit/27bad28c530c89acab35a56b945b6a3924280f4bPatch, Third Party Advisory
• https://github.com/discourse/discourse/commit/ddb458343dc39a7a8c99467dcd809b444514fe2cPatch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-vm3x-w6jm-j9vvThird Party Advisory

Published

Sep 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41077The activation process in Travis CI, for certain 2021-09-03 …7.5
• CVE-2021-41078Nameko through 2.13.0 can be tricked into performing arbitra…7.8
• CVE-2021-41079Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0…7.5
• CVE-2021-4108snipe-it is vulnerable to Improper Neutralization of Input D…6.1
• CVE-2021-41080Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41083Dada Mail is a web-based e-mail list management system. In a…8.8
• CVE-2021-41084http4s is an open source scala interface for HTTP. In affect…4.7
• CVE-2021-41086jsuites is an open source collection of common required java…5.4
• CVE-2021-41087in-toto-golang is a go implementation of the in-toto framewo…6.5
• CVE-2021-41088Elvish is a programming language and interactive shell, comb…8.8
• CVE-2021-41089Moby is an open-source project created by Docker to enable s…6.3