Discourse Chat Permission Bypass Vulnerability

A vulnerability exists in Discourse versions through 3.3.2, beta through 3.4.0.beta3, and tests-passed through 3.4.0.beta3, allowing users who disable chat in their preferences to still be reachable in certain situations. This issue has been addressed in Discourse versions 3.3.3, 3.4.0.beta4, and 3.4.0.beta4 in the tests-passed branch.

Impact

Exploitation of this vulnerability could lead to a bypass of chat permissions, allowing users to be contacted via chat even after disabling the feature in their preferences.

Remediation

Users are advised to upgrade to Discourse versions 3.3.3, 3.4.0.beta4, or 3.4.0.beta4 in the tests-passed branch. For those unable to upgrade, the chat plugin can be disabled within site settings.