CVE-2022-41913
Discourse-calendar exposes members of hidden groups
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit ca5ae3e7e which will be included in future releases. Users unable to upgrade should disable the discourse_post_event_enabled setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the discourse_post_event_allowed_on_groups but note that moderators will still be able to use it.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Discourse-calendar exposes members of hidden groups
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit ca5ae3e7e which will be included in future releases. Users unable to upgrade should disable the discourse_post_event_enabled setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the discourse_post_event_allowed_on_groups but note that moderators will still be able to use it.
- Record
CVE-2022-41913- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-45044
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit ca5ae3e7e which will be included in future releases. Users unable to upgrade should disable the discourse_post_event_enabled setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the discourse_post_event_allowed_on_groups but note that moderators will still be able to use it.
- Record
EUVD-2022-45044- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
NVD
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit ca5ae3e7e which will be included in future releases. Users unable to upgrade should disable the discourse_post_event_enabled setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the discourse_post_event_allowed_on_groups but note that moderators will still be able to use it.
- Record
CVE-2022-41913- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Discourse-calendar exposes members of hidden groups
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit ca5ae3e7e which will be included in future releases. Users unable to upgrade should disable the discourse_post_event_enabled setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the discourse_post_event_allowed_on_groups but note that moderators will still be able to use it.
- Record
CVE-2022-41913- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-41913 is a medium vulnerability (CVSS 4.3) in Discourse Calendar, published November 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.