CVE-2024-36113

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing them from logging in to the site. The issue is patched in version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch. No known workarounds are available.

• CWE-862
• CWE-862

• https://github.com/discourse/discourse/commit/8470546f59b04bd82ce9b711406758fd5439936dPatch
• https://github.com/discourse/discourse/commit/9c4a5f39d3ad351410a1453ff5e5f7ffce17cd7ePatch
• https://github.com/discourse/discourse/security/advisories/GHSA-3w3f-76p7-3c4gThird Party Advisory
• https://github.com/discourse/discourse/commit/8470546f59b04bd82ce9b711406758fd5439936dPatch
• https://github.com/discourse/discourse/commit/9c4a5f39d3ad351410a1453ff5e5f7ffce17cd7ePatch
• https://github.com/discourse/discourse/security/advisories/GHSA-3w3f-76p7-3c4gThird Party Advisory

Published

Jul 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36108casgate is an Open Source Identity and Access Management sys…9.8
• CVE-2024-36109CoCalc is web-based software that enables collaboration in r…7.6
• CVE-2024-3611The Toolbar Extras for Elementor & More – WordPress Admin Ba…6.4
• CVE-2024-36110ansibleguy-webui is an open source WebUI for using Ansible. …8.2
• CVE-2024-36111KubePi is a K8s panel. Starting in version 1.6.3 and prior t…6.3
• CVE-2024-36112Nautobot is a Network Source of Truth and Network Automation…6.5
• CVE-2024-36114Aircompressor is a library with ports of the Snappy, LZO, LZ…8.6
• CVE-2024-36115Reposilite is an open source, lightweight and easy-to-use re…7.1
• CVE-2024-36116Reposilite is an open source, lightweight and easy-to-use re…9.8
• CVE-2024-36117Reposilite is an open source, lightweight and easy-to-use re…7.5
• CVE-2024-36118MeterSphere is a test management and interface testing tool.…4.3
• CVE-2024-36119Statamic is a, Laravel + Git powered CMS designed for buildi…1.8