Discourse Username Change Vulnerability via `activate-account` Route

A vulnerability exists in Discourse versions beta through 3.4.0.beta3 and in the 'tests-passed' version range through 3.4.0.beta3. This issue allows an attacker to manipulate a user's username by sending a carefully crafted link that exploits the 'activate-account' route. The vulnerability requires user interaction to be exploited.

Impact

Exploitation of this vulnerability allows for unauthorized changes to a user's username.

Remediation

Users are advised to upgrade to Discourse version 3.4.0.beta4 or later. Instructions for upgrading can be found in the Discourse documentation.