CVE-2022-21678

Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.

• CWE-200
• CWE-863

• https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6dePatch, Third Party Advisory
• https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6cPatch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564mPatch, Third Party Advisory
• https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6dePatch, Third Party Advisory
• https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6cPatch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564mPatch, Third Party Advisory

Published

Jan 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21671@replit/crosis is a JavaScript client that speaks Replit's c…6.5
• CVE-2022-21672make-ca is a utility to deliver and manage a complete PKI co…6.5
• CVE-2022-21673Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2022-21675Bytecode Viewer (BCV) is a Java/Android reverse engineering …7.8
• CVE-2022-21676Engine.IO is the implementation of transport-based cross-bro…7.5
• CVE-2022-21677Discourse is an open source discussion platform. Discourse g…5.3
• CVE-2022-21679Istio is an open platform to connect, manage, and secure mic…9.8
• CVE-2022-2168The Download Manager WordPress plugin before 3.2.44 does not…6.1
• CVE-2022-21680Marked is a markdown parser and compiler. Prior to version 4…7.5
• CVE-2022-21681Marked is a markdown parser and compiler. Prior to version 4…7.5
• CVE-2022-21682Flatpak is a Linux application sandboxing and distribution f…6.5
• CVE-2022-21683Wagtail is a Django based content management system focused …4.3