Read the docs
TI-2022-20254 Aliases CVE-2022-41913

Discourse-calendar exposes members of hidden groups

Priority LOW 25CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit `ca5ae3e7e` which will be included in future releases. Users unable to upgrade should disable the `discourse_post_event_enabled` setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the `discourse_post_event_allowed_on_groups` but note that moderators will still be able to use it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Fix Fixed discourse-calendar (discourse): 0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
discoursediscourse-calendarbefore 0.30.3Patch availableCNA
  • discourse-calendar Vendordiscourse Affected before 0.3 Fixed in 0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:discourse:calendar:0.2:*:*:*:*:*:*:*0.2Vulnerablediscourse
  • cpe:2.3:a:discourse:calendar:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·discourse

Remediation

  • Fix · CNA discourse-calendar (discourse) Fixed in 0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41913

References

Patch 1

Advisory 1

  • TI-2024-17235 Uninvited user is able to join and mark the attendance of the the private event CVSS 3.1MEDIUM 6.5
  • TI-2024-30374 Discourse Calendar plugin event names susceptible to XSS CVSS 3.1MEDIUM 6.1
  • TI-2024-16334 User can see invitees in events created in PMs and private categories CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences