Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-49845
Good to know:
Date: June 25, 2025
Discourse is an open-source discussion platform. The visibility of posts typed "whisper" is controlled via the "whispers_allowed_groups" site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed "whisper". However, it has been discovered that users of versions prior to 3.4.6 on the "stable" branch and prior to 3.5.0.beta8-dev on the "tests-passed" branch can continue to see their own whispers even after losing visibility of posts typed "whisper". This issue is patched in versions 3.4.6 and 3.5.0.beta8-dev. No known workarounds are available.
Severity Score
Severity Score
Weakness Type (CWE)
Exposure of Sensitive Information to an Unauthorized Actor
CWE-200Top Fix
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | NONE |
| Availability (A): | NONE |