PT-2026-5184 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-68660

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. An endpoint allows any authenticated user to bypass the ai discover persona access controls and gain ongoing direct message (DM) access to personas. These personas may be linked to staff-only categories, Retrieval-Augmented Generation (RAG) document sets, or automated tooling, potentially leading to unauthorized data disclosure. The controller accepts an arbitrary user id, enabling an attacker to impersonate other accounts and initiate unwanted AI conversations on their behalf, potentially generating confusing or abusive private message traffic.

Recommendations Update Discourse to version 3.5.4 or later. Update Discourse to version 2025.11.2 or later. Update Discourse to version 2025.12.1 or later. Update Discourse to version 2026.1.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DISCOURSE-2025-68660

CVE-2025-68660

GHSA-MRVM-RPRQ-JQQH

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68660.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68660 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-68660 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-mrvm-rprq-jqqh · Note
• https://twitter.com/CVEnew/status/2016587737709654111 · Twitter Post