← Back

CVE-2025-68662

nvd nist
Published: Jan 28, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: NVD

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Affected (4)

Products: Discourse: Discourse
Discourse
1 product
Discourse
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Discourse
Discourse
Before 3.5.4
Discourse
From 2025.11.0 to 2025.11.2
Discourse
Version 2025.12.0
Discourse
Version 2026.1.0

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security-advisories@github.com
Third Party Advisory

Timeline

No history available yet.