CVE-2025-24972

Description

Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.

Reserved 2025-01-29 | Published 2025-03-26 | Updated 2025-03-26 | Assigner GitHub_M

Problem types

CWE-862: Missing Authorization

Product status

< 3.3.4
affected

>= 3.4.0.beta1, < 3.4.0.beta5
affected

References

github.com/...course/security/advisories/GHSA-4p63-qw6g-4mv2

cve.org (CVE-2025-24972)

nvd.nist.gov (CVE-2025-24972)

Download JSON