CVE-2022-39355

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number 846d012151514b35ce42a1636c7d70f6dcee879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with an unverified-email Patreon account will be logged out and asked to verify their email address on their next login. As a workaround, disable the patreon integration and log out all users with associated Patreon accounts.

• CWE-287
• CWE-287

• https://github.com/discourse/discourse-patreon/commit/846d012151514b35ce42a1636c7d70f6dcee879ePatch, Third Party Advisory
• https://github.com/discourse/discourse-patreon/security/advisories/GHSA-fvj9-f67v-qpr4Third Party Advisory
• https://github.com/discourse/discourse-patreon/commit/846d012151514b35ce42a1636c7d70f6dcee879ePatch, Third Party Advisory
• https://github.com/discourse/discourse-patreon/security/advisories/GHSA-fvj9-f67v-qpr4Third Party Advisory

Published

Oct 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3935The Welcart e-Commerce WordPress plugin before 2.8.4 does no…5.4
• CVE-2022-39350@dependencytrack/frontend is a Single Page Application (SPA)…5.4
• CVE-2022-39351Dependency-Track is a Component Analysis platform that allow…4.4
• CVE-2022-39352OpenFGA is a high-performance authorization/permission engin…9.8
• CVE-2022-39353xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…9.8
• CVE-2022-39354SputnikVM, also called evm, is a Rust implementation of Ethe…7.5
• CVE-2022-39356Discourse is a platform for community discussion. Users who …8.8
• CVE-2022-39357Winter is a free, open-source content management system base…9.8
• CVE-2022-39358Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-39359Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-3936The Team Members WordPress plugin before 5.2.1 does not sani…4.8
• CVE-2022-39360Metabase is data visualization software. Prior to versions 0…6.5