CVE-2022-46168

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is not an issue as they are likely already familiar with one another's email addresses. This issue is patched in versions 2.8.14 and 2.9.0.beta15. The fix is that someone sending emails out via group SMTP to non-staged users masks those emails with blind carbon copy (BCC). Staged users are ones that have likely only interacted with the group via email, and will likely include other people who were CC'd on the original email to the group. As a workaround, disable group SMTP for any groups that have it enabled.

• CWE-359

• https://github.com/discourse/discourse/pull/19724Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-8p7g-3wm6-p3rmThird Party Advisory
• https://github.com/discourse/discourse/pull/19724Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-8p7g-3wm6-p3rmThird Party Advisory

Published

Jan 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46162discourse-bbcode is the official BBCode plugin for Discourse…9.8
• CVE-2022-46163Travel support program is a rails app to support the travel …7.5
• CVE-2022-46164NodeBB is an open source Node.js based forum software. Due t…9.8
• CVE-2022-46165Syncthing is an open source, continuous file synchronization…5.4
• CVE-2022-46166Spring boot admins is an open source administrative user int…9.8
• CVE-2022-46167Capsule is a multi-tenancy and policy-based framework for Ku…8.8
• CVE-2022-46169Cacti is an open source platform which provides a robust and…9.8
• CVE-2022-4617Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2022-46170CodeIgniter is a PHP full-stack web framework. When an appli…9.8
• CVE-2022-46171Tauri is a framework for building binaries for all major des…7.7
• CVE-2022-46172authentik is an open-source Identity provider focused on fle…6.4
• CVE-2022-46173Elrond-GO is a go implementation for the Elrond Network prot…6.5