PT-2025-18290 · Discourse · Discourse

Tgxworld · Published 2025-04-30 · Updated 2025-05-02 · CVE-2025-32376

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.4.3 Discourse versions prior to 3.5.0.beta3

Description Discourse is an open-source discussion platform. In versions prior to 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the user limit for a direct message (DM) can be bypassed. This allows the creation of a DM with all users of a site.

Recommendations For versions prior to 3.4.3, update to version 3.4.3 or later to resolve the issue. For versions prior to 3.5.0.beta3, update to version 3.5.0.beta3 or later to resolve the issue.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-DISCOURSE-2025-32376

CVE-2025-32376

GHSA-MQQQ-H2X3-46FR

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32376.json · Exploit
• https://github.com/discourse/discourse/commit/21a7f3162221c393f9bb13721451aa7f237d881a · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-mqqq-h2x3-46fr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32376 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-32376 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32376 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1917696883323003200 · Twitter Post
• https://t.me/cvedetector/24111 · Telegram Post
• https://twitter.com/CVEnew/status/1917598956437266915 · Twitter Post
• https://t.me/cvetracker/22723 · Telegram Post