CVE-2022-31096

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite has been configured to add the user that accepts the invite into restricted groups. Once a user has been incorrectly added to a restricted group, the user may then be able to view content which that are restricted to the respective group. Users are advised to upgrade to the current stable releases. There are no known workarounds to this issue.

• CWE-281
• CWE-281

• https://github.com/discourse/discourse/security/advisories/GHSA-rvp8-459h-282rThird Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-rvp8-459h-282rThird Party Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31090Guzzle, an extensible PHP HTTP client. `Authorization` heade…7.7
• CVE-2022-31091Guzzle, an extensible PHP HTTP client. `Authorization` and `…7.7
• CVE-2022-31092Pimcore is an Open Source Data & Experience Management Platf…8.1
• CVE-2022-31093NextAuth.js is a complete open source authentication solutio…7.5
• CVE-2022-31094ScratchTools is a web extension designed to make interacting…6.1
• CVE-2022-31095discourse-chat is a chat plugin for the Discourse applicatio…6.5
• CVE-2022-31097Grafana is an open-source platform for monitoring and observ…8.7
• CVE-2022-31098Weave GitOps is a simple open source developer platform for …7.5
• CVE-2022-31099rulex is a new, portable, regular expression language. When …6.5
• CVE-2022-3110An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31100rulex is a new, portable, regular expression language. When …6.5
• CVE-2022-31101prestashop/blockwishlist is a prestashop extension which add…8.8