CVE-2022-41913

Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit `ca5ae3e7e` which will be included in future releases. Users unable to upgrade should disable the `discourse_post_event_enabled` setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the `discourse_post_event_allowed_on_groups` but note that moderators will still be able to use it.

• CWE-200

• https://github.com/discourse/discourse-calendar/commit/ca5ae3e7e0c2b32af5ca4ec69c95e95b2ecef2e9Patch, Third Party Advisory
• https://github.com/discourse/discourse-calendar/security/advisories/GHSA-jh96-w279-g7r9Third Party Advisory
• https://github.com/discourse/discourse-calendar/commit/ca5ae3e7e0c2b32af5ca4ec69c95e95b2ecef2e9Patch, Third Party Advisory
• https://github.com/discourse/discourse-calendar/security/advisories/GHSA-jh96-w279-g7r9Third Party Advisory

Published

Nov 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41908TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-41909TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-4191Use after free in Sign-In in Google Chrome prior to 108.0.53…8.8
• CVE-2022-41910TensorFlow is an open source platform for machine learning. …9.1
• CVE-2022-41911TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-41912The crewjam/saml go library prior to version 0.4.9 is vulner…9.8
• CVE-2022-41914Zulip is an open-source team collaboration tool. For organiz…3.7
• CVE-2022-41915Netty project is an event-driven asynchronous network applic…6.5
• CVE-2022-41916Heimdal is an implementation of ASN.1/DER, PKIX, and Kerbero…7.5
• CVE-2022-41917OpenSearch is a community-driven, open source fork of Elasti…4.3
• CVE-2022-41918OpenSearch is a community-driven, open source fork of Elasti…6.3
• CVE-2022-41919Fastify is a web framework with minimal overhead and plugin …8.8