PT-2025-26841 · Discourse · Discourse

Tgxworld · Published 2025-06-25 · Updated 2025-08-25 · CVE-2025-49845

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.4.6 Discourse versions prior to 3.5.0.beta8-dev

Description: Discourse is an open-source discussion platform where the visibility of posts typed whisper is controlled via the whispers allowed groups site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed whisper. However, it has been discovered that users can continue to see their own whispers even after losing visibility of posts typed whisper.

Recommendations: For versions prior to 3.4.6, update to version 3.4.6 or later. For versions prior to 3.5.0.beta8-dev, update to version 3.5.0.beta8-dev or later.

Exploit

Fix

LPE

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2025-49845

CVE-2025-49845

GHSA-79QW-R73R-69GF

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49845.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-79qw-r73r-69gf · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2025-49845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49845 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49845 · Vendor Advisory
• https://twitter.com/CVEnew/status/1937902283561583002 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937939321928982939 · Twitter Post
• https://t.me/cveNotify/133363 · Telegram Post