Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages ar...

CVE-2021-41140 · published 5 years ago
Summary

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update a...

What to do
  • Update discourse discourse_reactions to version 0.2 or later.
Affected software
VendorProductAffected versions
discourse discourse_reactions < 0.2
cpe:2.3:a:discourse:discourse_reactions:*:*:*:*:*:discourse:*:*
Original advisory text
Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages ar...
Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-668Exposure of Resource to Wrong Sphere
CWE-200Information Exposure
Timeline
Published19 Oct 2021
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-41140 · NVD
Track software like this
Free during beta