Threats Tagged 'bitnami'

A vulnerability in Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 allows newly registered users during signup to assign themselves a primary_group_id. This improper assignment grants them whisper-group privileges without legitimate membership on sites configured with whispers_allowed_groups. The issue has been fixed in the specified patched versions.

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 have a vulnerability where private event invitee information is exposed to unauthorized users. Specifically, the EventSerializer component could leak invited group names, sample invitees, and attendance statistics to users who can view the topic but should not see the private event invitee list. This issue has been fixed in the stated versions.

Discourse versions prior to 2026.1.5, 2026.4.2, and 2026.5.1 have a vulnerability where secure uploads could be exposed via the pull_hotlinked_images feature if an attacker knew the secured upload URL and the secure_uploads setting was enabled. This issue allows unauthorized access to uploads intended to be secure. The vulnerability is fixed in versions 2026.1.5, 2026.4.2, and 2026.5.1 and later.

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 contain a vulnerability where regular users could route direct S3 multipart uploads through the ExternalUploadManager into the admin backup store. This issue has been fixed in the specified versions. The vulnerability is classified as medium severity.

Discourse versions prior to 2026.1.5, 2026.4.2, and 2026.5.1 could leak restricted tag and tag-group names via category and group endpoints to unauthorized and anonymous users. This information disclosure affects tags attached to publicly readable categories. The issue is fixed in versions 2026.1.5, 2026.4.2, and 2026.5.1 and later.

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 contain a vulnerability in the AWS SES bounce webhook. The webhook verified that SNS messages were signed by Amazon but failed to restrict them to trusted TopicArn values. This allowed any AWS account holder to send validly signed forged bounce notifications, which could disable a targeted user's email. The issue is fixed in the specified patched versions.

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 contain insufficient SVG sanitization in upload and user avatar handling. This vulnerability could allow cross-site scripting (XSS) when users visit certain uncommon URLs. The issue has been fixed in the specified later versions.

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 contain a stored cross-site scripting (XSS) vulnerability in the two-factor authentication (2FA) delete confirmation modal. The vulnerability arises because a malicious second factor name on an attacker-controlled account is not properly escaped in the confirmation dialog. This flaw can be triggered when an administrator impersonates the affected account. The issue is fixed in the specified patched versions.

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 contain a stored cross-site scripting (XSS) vulnerability in the topic featured link feature. The vulnerability arises because the featured link was not properly normalized and escaped before rendering in the topic list. This allows a user with permission to set a featured link to inject JavaScript code if the default Content Security Policy protections are modified or disabled. The issue has been fixed in the specified versions.