CVE-2024-49765: 
NixOS vulnerability analysis and mitigation

Discourse, an open source platform for community discussion, was found to contain a security vulnerability (CVE-2024-49765) that affects sites using Discourse Connect with local logins enabled. The vulnerability was discovered and disclosed on December 19, 2024, affecting versions stable <= 3.3.2, beta <= 3.4.0.beta3, and tests-passed <= 3.4.0.beta3 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, has unchanged scope, and can impact confidentiality but not integrity or availability (NVD).

The vulnerability allows attackers to bypass Discourse Connect authentication mechanisms to create accounts and login when local logins are enabled alongside Discourse Connect. This could potentially lead to unauthorized access to the platform (GitHub Advisory).

The vulnerability can be exploited remotely without requiring any special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit in systems where both Discourse Connect and local logins are enabled (NVD).

The vulnerability has been patched in versions stable >= 3.3.3, beta >= 3.4.0.beta4, and tests-passed >= 3.4.0.beta4. For users unable to upgrade who are using Discourse Connect, a workaround is available by disabling all other login methods (GitHub Advisory).