| Package | Affected versions | Patched versions |
|---|---|---|
| discourse | = 3.4.0< 3.3.4< 3.4.0 | 3.3.43.4.0 |
Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free