CVE-2025-47288

Published: May 29, 2025Modified: Jun 17, 2026Deferred

3.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.1 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1. A workaround involves moving any policy topics with private groups to restricted categories.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://github.com/discourse/discourse-policy/commit/6b4390fe486408cc86ccea6b091406cfac6c5b8f

Source: security-advisories@github.com

https://github.com/discourse/discourse-policy/security/advisories/GHSA-jc5r-rm2j-mh4x

Source: security-advisories@github.com

Timeline

No history available yet.