CVE-2024-45051: Discourse

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Discourse Discourse: before 3.3.2 (fixed in 3.3.2); before 3.4.0 (fixed in 3.4.0); version 3.4.0 only

Published 2024-10-07. Last modified 2026-06-17.