PT-2026-5182 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-68479

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Certain subscription endpoints do not adequately verify ownership before allowing modifications. This could allow unauthorized changes to subscriptions. No information is available regarding the number of potentially affected devices or any real-world incidents where this issue was exploited.

Recommendations Update Discourse to version 3.5.4 or later. Update Discourse to version 2025.11.2 or later. Update Discourse to version 2025.12.1 or later. Update Discourse to version 2026.1.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2025-68479

CVE-2025-68479

GHSA-6GJR-5897-M327

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68479.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68479 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-68479 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-6gjr-5897-m327 · Note
• https://twitter.com/CVEnew/status/2016587741622927452 · Twitter Post