PT-2026-5195 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-69289

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. A privilege escalation issue exists in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. This allows a non-admin moderator to bypass email-change restrictions, potentially leading to account takeover of non-staff accounts.

Recommendations Update to Discourse version 3.5.4 or later. Update to Discourse version 2025.11.2 or later. Update to Discourse version 2025.12.1 or later. Update to Discourse version 2026.1.0 or later. As a workaround, ensure moderators are trusted. As a workaround, enable the "require change email confirmation" setting.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DISCOURSE-2025-69289

CVE-2025-69289

GHSA-P39J-X54C-RWQQ

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69289.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2025-69289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69289 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69289 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-p39j-x54c-rwqq · Note
• https://t.me/CVEtracker/43175 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016709350039896134 · Twitter Post
• https://twitter.com/CVEnew/status/2016601777182064930 · Twitter Post