This repository has been archived by the owner on Feb 6, 2023. It is now read-only.
Chat message lookup did not check channel access
Package
discourse-chat
(Discourse)
Affected versions
stable <= 0.3
Patched versions
stable >= 0.4
Impact
A maliciously-formed request allowed users to view messages they should not be able to see.
Workarounds
None, upgrading the plugin to the latest version is required.