UpHeron
All vulnerabilities

Servers and applications

CVE-2025-68479

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Severity
Medium 5.3
Published
28 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.4, 2025.11.2
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.5.4
  • From 2025.11.0 before 2025.11.2
  • Version 2025.12.0
  • Version 2026.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-68479
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-68479