CVE-2025-24972

Published: Mar 26, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.

Affected (6)

Products: Discourse: Discourse

Discourse

1 product

Discourse

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	Before 3.4.0
Discourse Discourse	Before 3.3.4
Discourse Discourse	Version 3.4.0 beta1
Discourse Discourse	Version 3.4.0 beta2
Discourse Discourse	Version 3.4.0 beta3
Discourse Discourse	Version 3.4.0 beta4

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://github.com/discourse/discourse/security/advisories/GHSA-4p63-qw6g-4mv2

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.