 
                        We found results for “”
CVE-2025-24972
Good to know:
 
                                    Date: March 26, 2025
Discourse is an open-source discussion platform. Prior to versions "3.3.4" on the "stable" branch and "3.4.0.beta5" on the "beta" branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions "3.3.4" and "3.4.0.beta5" contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.
Severity Score
Severity Score
Weakness Type (CWE)
Missing Authorization
CWE-862Top Fix
 
                                    CVSS v3.1
| Base Score: |  | 
|---|---|
| Attack Vector (AV): | NETWORK | 
| Attack Complexity (AC): | LOW | 
| Privileges Required (PR): | LOW | 
| User Interaction (UI): | NONE | 
| Scope (S): | UNCHANGED | 
| Confidentiality (C): | NONE | 
| Integrity (I): | LOW | 
| Availability (A): | NONE | 
 Vulnerabilities
                        Vulnerabilities
                 Projects
                        Projects
                 Vulnerability Disclosure
                        Vulnerability Disclosure
                 About Us
                    About Us
                 Contact Us
                    Contact Us
                

