CVE-2025-68479

Published: Jan 28, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Affected (4)

Products: Discourse: Discourse

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	Before 3.5.4
Discourse Discourse	From 2025.11.0 to 2025.11.2
Discourse Discourse	Version 2025.12.0
Discourse Discourse	Version 2026.1.0

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://github.com/discourse/discourse/security/advisories/GHSA-6gjr-5897-m327

Source: security-advisories@github.com

Third Party Advisory

Timeline

No history available yet.