Discourse Race Condition in Accept Invite (CVE-2023-37904)

Summary

Discourse Race Condition in Accept Invite

Original description

The description as published by the source.

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches. As a workaround, use restrict to email address invites.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami discourse

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.6"}]}]

References

advisory github.com
patch github.com
web nvd.nist.gov