CVE-2021-32788

    Dashboard / Vulnerabilities / CVE-2021-32788

    CVE-2021-32788

    Published: 27 Jul 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.

    References: https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92, https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5, https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b47c5f69d859866c1b42cd316f11dae4270b118f

    Affected versions

    v2.7.6
    v2.7.5
    v2.7.4
    v2.7.3
    v2.7.2
    v2.7.1
    v2.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32788 | CVE-DB