All vulnerabilities

Servers and applications

CVE-2025-24808

Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in…

Severity
Low 3.1
Published
26 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.3.3, 3.4.0
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.3.3
  • Every version before 3.4.0
  • Version 3.4.0-beta1
  • Version 3.4.0-beta2
  • Version 3.4.0-beta3
  • Version 3.4.0-beta4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-24808
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24808