PT-2025-19796 · Discourse · Discourse

Pmusaraj · Published 2025-05-05 · Updated 2025-09-26 · CVE-2025-46813

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 3.5.0.beta4 before commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b

Description A data leak issue affects Discourse, an open-source community platform, allowing some content on the site's homepage to be visible to unauthenticated users on login-required sites. The issue affects sites deployed between April 30, 2025, noon EDT, and May 2, 2025, noon EDT. Private content on an instance's homepage could be visible to unauthenticated users. Sites on the stable branch are unaffected.

Recommendations For Discourse versions 3.5.0.beta4 before commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b, upgrade to a non-vulnerable version of Discourse to resolve the issue. No workarounds are available, and sites must be upgraded to a secure version to prevent the data leak.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-46813

GHSA-V3H7-C287-PFG9

Affected Products

Discourse

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46813.json · Exploit
• https://github.com/discourse/discourse/commit/10df7fdee060d44accdee7679d66d778d1136510 · Patch
• https://github.com/discourse/discourse/commit/82d84af6b0efbd9fa2aeec3e91ce7be1a768511b · Patch
• https://osv.dev/vulnerability/CVE-2025-46813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46813 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9 · Note
• https://twitter.com/CVEnew/status/1919491176605929590 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1919515167060099253 · Twitter Post
• https://t.me/cvedetector/24506 · Telegram Post
• https://t.me/cveNotify/136527 · Telegram Post
• https://t.me/cvetracker/23083 · Telegram Post