CVE-2021-37693

Re-use of email tokens in Discourse

State: Published
Severity: 5.3 Medium
Published: Aug 13, 2021
Updated: Aug 4, 2024
Reserved: Jul 29, 2021

Description

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-640 Weak Password Recovery Mechanism for Forgotten Password
CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
discoursediscourse	< 2.7.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.