CVE-2022-24866

CVE-2022-24866 is a medium-severity information disclosure vulnerability affecting the Discourse Assign plugin prior to version 1.0.1. It allowed the UserBookmarkSerializer to leak private user and group information to individuals with assignment viewing privileges, typically staff members. While the CVSS score is 4.3, indicating low impact, the vulnerability could expose sensitive data on sites where assign features are publicly enabled. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.