UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64528

Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.

Severity
Medium 6.3
Published
30 Dec 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.3
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.5.3
  • Version 2025.11.0
  • Version 2025.12.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64528
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64528