Skip to content
Heist/ feed
MediumFix available

Discourse users archives leaked to users with moderation privileges

Type: advisorySource: OSV1 source record

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. To work around this problem, a site admin can temporarily revoke the moderation role from all moderators until the Discourse instance has been upgraded to a version that has been patched.

Announced Source revision 1
Original source ↗

BIT-discourse-2025-68666

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-discourse-2025-68666

discourse

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
3.5.4

Source reference: /affected/0/ranges

2025.11.2

Source reference: /affected/0/ranges

2025.12.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.5.4"
          },
          {
            "introduced": "2025.11.0"
          },
          {
            "fixed": "2025.11.2"
          },
          {
            "introduced": "2025.12.0"
          },
          {
            "fixed": "2025.12.1"
          }
        ]
      }
    ],
    "package": {
      "name": "discourse",
      "purl": "pkg:bitnami/discourse",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V4",
        "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2025-68666.json"
    }
  }
]
Related CVEs
CVE-2025-68666

Source reference: /aliases

Publisher severity

medium

Source reference: /database_specific/severity

Event
#84188 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement