PT-2025-12891 · Discourse · Discourse

Published 2025-03-26 · Updated 2025-03-28 · CVE-2025-24972

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.3.4 Discourse versions prior to 3.4.0.beta5

Description The issue affects Discourse, an open-source discussion platform, where users could be added to group direct messages despite disabling direct messaging in their preferences under specific circumstances.

Recommendations For versions prior to 3.3.4, update to version 3.3.4 or later to resolve the issue. For versions prior to 3.4.0.beta5, update to version 3.4.0.beta5 or later to resolve the issue. As a temporary workaround, consider disabling chat in user preferences to prevent being added to new group chats.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2025-24972

CVE-2025-24972

GHSA-4P63-QW6G-4MV2

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24972.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2025-24972 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24972 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-4p63-qw6g-4mv2 · Note
• https://twitter.com/CVEnew/status/1904905341097107785 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1904912841804570812 · Twitter Post