PT-2026-5186 · Discourse · Discourse

CVE-2025-68666 · Publicado 2026-01-28 · Atualizado 2026-02-02

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Users archives are viewable by users with moderation privileges, even though moderators should not have access to the archives. This leads to a breach of confidentiality as private topic/post content made by users is leaked through the archives.

Recommendations Upgrade to Discourse version 3.5.4 or later. Upgrade to Discourse version 2025.11.2 or later. Upgrade to Discourse version 2025.12.1 or later. Upgrade to Discourse version 2026.1.0 or later. As a temporary workaround, a site admin can revoke the moderation role from all moderators until the Discourse instance has been upgraded to a patched version.

Exploit

Correção

LPE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-DISCOURSE-2025-68666

CVE-2025-68666

GHSA-XMVW-JJQQ-25MV

Produtos afetados

Discourse

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68666.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-xmvw-jjqq-25mv · Nota
• https://twitter.com/VulmonFeeds/status/2016719589858570704 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68666 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2016596622625415311 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-68666 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-discourse-2025-68666 · Aviso do Fabricante