PT-2025-19796 · Discourse · Discourse

Pmusaraj · Publicado 2025-05-05 · Atualizado 2025-09-26 · CVE-2025-46813

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 3.5.0.beta4 before commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b

Description A data leak issue affects Discourse, an open-source community platform, allowing some content on the site's homepage to be visible to unauthenticated users on login-required sites. The issue affects sites deployed between April 30, 2025, noon EDT, and May 2, 2025, noon EDT. Private content on an instance's homepage could be visible to unauthenticated users. Sites on the stable branch are unaffected.

Recommendations For Discourse versions 3.5.0.beta4 before commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b, upgrade to a non-vulnerable version of Discourse to resolve the issue. No workarounds are available, and sites must be upgraded to a secure version to prevent the data leak.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-46813

GHSA-V3H7-C287-PFG9

Produtos afetados

Discourse

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46813.json · Exploit
• https://github.com/discourse/discourse/commit/10df7fdee060d44accdee7679d66d778d1136510 · Correção
• https://github.com/discourse/discourse/commit/82d84af6b0efbd9fa2aeec3e91ce7be1a768511b · Correção
• https://github.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9 · Nota
• https://twitter.com/CVEnew/status/1919491176605929590 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1919515167060099253 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-46813 · Aviso do Fabricante
• https://t.me/cvedetector/24506 · Publicação no Telegram
• https://t.me/cveNotify/136527 · Publicação no Telegram
• https://t.me/cvetracker/23083 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-46813 · Nota de Segurança