
We found results for “”
CVE-2025-24972
Good to know:

Date: March 26, 2025
Discourse is an open-source discussion platform. Prior to versions "3.3.4" on the "stable" branch and "3.4.0.beta5" on the "beta" branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions "3.3.4" and "3.4.0.beta5" contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.
Severity Score
Severity Score
Weakness Type (CWE)
Missing Authorization
CWE-862Top Fix

CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | LOW |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | LOW |
Availability (A): | NONE |