PT-2026-5194 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-69218

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Moderators can access the top uploads admin report, which should be restricted to administrators only. This report displays direct URLs to all uploaded files on the site, potentially including sensitive content such as user data exports, admin backups, and other private attachments that moderators should not have access to. The top uploads report provides access to sensitive data.

Recommendations Update Discourse to version 3.5.4 or later. Update Discourse to version 2025.11.2 or later. Update Discourse to version 2025.12.1 or later. Update Discourse to version 2026.1.0 or later. Limit moderator privileges to trusted users until the patch is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DISCOURSE-2025-69218

CVE-2025-69218

GHSA-79F9-J8H4-3W6W

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69218.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-69218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69218 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-69218 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-79f9-j8h4-3w6w · Note
• https://twitter.com/CVEnew/status/2016601785021190576 · Twitter Post
• https://t.me/CVEtracker/43168 · Telegram Post
• https://twitter.com/pulsepatchio/status/2018337499924382137 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016711909978894567 · Twitter Post