CVE-2024-26145

Summary

CVE-2024-26145 is a vulnerability affecting Discourse Calendar. This issue allows uninvited users to access private events by crafting a request to update their attendance in the first post of a topic. The flaw exists due to insufficient access controls. A fix for this problem has been implemented in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a temporary measure, users can restrict calendar post visibility to limit access to this feature.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.