CVE-2022-31060

Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.

• CWE-200

• https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027f0ec59aPatch, Third Party Advisory
• https://github.com/discourse/discourse/pull/17071Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhqThird Party Advisory
• https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027f0ec59aPatch, Third Party Advisory
• https://github.com/discourse/discourse/pull/17071Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhqThird Party Advisory

Published

Jun 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31055kCTF is a Kubernetes-based infrastructure for capture the fl…7.5
• CVE-2022-31056GLPI is a Free Asset and IT Management Software package, Dat…9.8
• CVE-2022-31057Shopware is an open source e-commerce software made in Germa…5.4
• CVE-2022-31058Tuleap is a Free & Open Source Suite to improve management o…7.2
• CVE-2022-31059Discourse Calendar is a calendar plugin for Discourse, an op…5.4
• CVE-2022-3106An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31061GLPI is a Free Asset and IT Management Software package, Dat…9.8
• CVE-2022-31062### Impact A plugin public script can be used to read conten…5.3
• CVE-2022-31063Tuleap is a Free & Open Source Suite to improve management o…5.4
• CVE-2022-31064BigBlueButton is an open source web conferencing system. Use…5.4
• CVE-2022-31065BigBlueButton is an open source web conferencing system. In …6.1
• CVE-2022-31066EdgeX Foundry is an open source project for building a commo…4.4