CVE-2025-32376

Katalog CVE

CVSS 4.3 · Medium EPSS 0,26%

Kerentanan Improper Access Control pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

Rincian

Terbit di NVD

30 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 232 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-mqqq-h2x3-46fr advisory vendor
• https://github.com/discourse/discourse/commit/21a7f3162221c393f9bb13721451aa7f237d881a patch