All vulnerabilities

Servers and applications

CVE-2025-68666

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4,…

Severity
Medium 5.9
Published
28 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.4, 2025.11.2
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.5.4
  • From 2025.11.0 before 2025.11.2
  • Version 2025.12.0
  • Version 2026.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-68666
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-68666