PT-2025-54189 · Discourse · Discourse

Davidtaylorhq · Published 2025-12-30 · Updated 2026-02-20 · CVE-2025-64528

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.3 Discourse versions prior to 2025.11.1 Discourse versions prior to 2025.12.0

Description Discourse is an open source discussion platform. An attacker who knows part of a username can find the user and their full name via the user interface or API, even when enable names is disabled. The issue occurs when an attacker knows a portion of a user’s username.

Recommendations Update to Discourse version 3.5.3 or later. Update to Discourse version 2025.11.1 or later. Update to Discourse version 2025.12.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-202

Related Identifiers

BIT-DISCOURSE-2025-64528

CVE-2025-64528

GHSA-C59W-JWX7-34V4

Affected Products

Discourse

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64528.json · Exploit
• https://github.com/discourse/discourse/commit/e936a523b5900a9d866d23ea3da904ba12bb0fb2 · Patch
• https://github.com/discourse/discourse/commit/1cb45b8b287597085e3514596ffb1d9b41938f81 · Patch
• https://github.com/discourse/discourse/commit/6192f55629624925595dae14364fd86cac0f09df · Patch
• https://osv.dev/vulnerability/BIT-discourse-2025-64528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64528 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64528 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-c59w-jwx7-34v4 · Note
• https://t.me/CVEtracker/40964 · Telegram Post
• https://t.me/cveNotify/152617 · Telegram Post
• https://twitter.com/CVEnew/status/2006132924949627196 · Twitter Post