Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/app/services
History
Exact
discoursebot 56e9ffc8f4
 SECURITY: Private event invitee details leak through invitees list endpoint [backport 2026.6] (#42112) 
Backport of #42109 to release/2026.6.

---

## Summary

The invitee-list route for private events previously authorized only
host-post visibility, allowing an authenticated viewer to retrieve
attendee identities, RSVP states, and attendance totals that should be
hidden. The fix enforces the same private-event detail policy used by
EventSerializer before returning invitee data, returning a 403 error to
unauthorized viewers.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1546

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-28 16:11:07 -05:00
..
discourse_calendar FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled (#40349) 2026-06-17 08:37:14 -05:00
discourse_post_event SECURITY: Private event invitee details leak through invitees list endpoint [backport 2026.6] (#42112) 2026-07-28 16:11:07 -05:00