Read the docs
TI-2021-18095 Aliases CVE-2021-41263GHSA-844m-cpr9-jcmh

Secure/signed cookies share secrets between sites in rails_multisite

Priority LOW 39CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application. The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.

Why it matters now

EPSS 0.00628 50th percentileScored 2026-11-07
Fix Fixed rails_multisite (discourse): 4.0.0rails_multisite (RubyGems): 4.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
discourserails_multisitebefore 4.0.04.0.0Patch availableCNA
—rails_multisite (RubyGems)before 4.0.04.0.0Patch availableGHSA-844m-cpr9-jcmh
  • rails_multisite Vendordiscourse Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
  • rails_multisite (RubyGems) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-844m-cpr9-jcmh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:discourse:rails_multisite:*:*:*:*:*:ruby:*:*before 4.0.0Vulnerablediscourse
  • cpe:2.3:a:discourse:rails_multisite:*:*:*:*:*:ruby:*:* Versions before 4.0.0 Vulnerable ·discourse

Remediation

  • Fix · CNA rails_multisite (discourse) Fixed in 4.0.0
  • Fix · GHSA-844m-cpr9-jcmh rails_multisite (RubyGems) Fixed in 4.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41263
  2. 2026-10-03 Alias added: GHSA-844m-cpr9-jcmh
  3. 2026-10-29 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences