PT-2026-5186 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-68666

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Users archives are viewable by users with moderation privileges, even though moderators should not have access to the archives. This leads to a breach of confidentiality as private topic/post content made by users is leaked through the archives.

Recommendations Upgrade to Discourse version 3.5.4 or later. Upgrade to Discourse version 2025.11.2 or later. Upgrade to Discourse version 2025.12.1 or later. Upgrade to Discourse version 2026.1.0 or later. As a temporary workaround, a site admin can revoke the moderation role from all moderators until the Discourse instance has been upgraded to a patched version.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DISCOURSE-2025-68666

CVE-2025-68666

GHSA-XMVW-JJQQ-25MV

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68666.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68666 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-68666 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-xmvw-jjqq-25mv · Note
• https://twitter.com/VulmonFeeds/status/2016719589858570704 · Twitter Post
• https://twitter.com/CVEnew/status/2016596622625415311 · Twitter Post