PT-2025-23195 · Discourse · Discourse Policy Plugin

Lillinator · CVE-2025-47288 · Published 2025-05-29 · Updated 2025-05-29

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse Policy plugin versions prior to 0.1.1

Description The issue concerns the Discourse Policy plugin, which allows confirming users have seen or done something. Prior to version 0.1.1, if a policy was posted to a public topic tied to a private group, the group members could be shown to non-group members.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 to resolve the issue. As a temporary workaround, consider moving any policy topics with private groups to restricted categories.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-47288

GHSA-JC5R-RM2J-MH4X

Affected Products

Discourse Policy Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47288.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47288 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47288 · Vendor Advisory
• https://github.com/discourse/discourse-policy/security/advisories/GHSA-jc5r-rm2j-mh4x · Note
• https://github.com/discourse/discourse-policy/commit/6b4390fe486408cc86ccea6b091406cfac6c5b8f · Note
• https://t.me/cvetracker/24929 · Telegram Post
• https://twitter.com/CVEnew/status/1928173935310606497 · Twitter Post