VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Dec 19, 2024· Updated Jun 17, 2026

CVE-2024-49765

CVE-2024-49765

Description

Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • Discourse (software)/Discourse7 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*+ 6 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*range: <3.4.0
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.3.3
    • cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.4.0:beta2:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.4.0:beta3:*:*:beta:*:*:*
    • (no CPE)
    • (no CPE)range: stable: <= 3.3.2
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.3.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.