CVE-2021-37601: Prosody

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.

Affected products

• Prosody Prosody: from 0.11.0, up to and including 0.11.9

Published 2021-07-30. Last modified 2026-06-17.