Account Manipulation Vulnerability in Discourse by Discourse
CVE-2025-22601

3.1LOW

Key Information:

Vendor
Discourse
Status
Discourse
Vendor
CVE Published:
4 February 2025

Summary

A vulnerability in Discourse allows attackers to exploit the activate-account route to manipulate a target user's account by crafting specially designed links. When a user clicks on such a link, they may unintentionally change their username, leading to potential security risks for their account. The vulnerability has been addressed in the latest version of Discourse, and users are strongly encouraged to upgrade to protect their accounts. Currently, there are no known workarounds for this issue, making immediate action essential.

Affected Version(s)

discourse beta: <= 3.4.0.beta3 <= beta: 3.4.0.beta3

discourse tests-passed: <= 3.4.0.beta3 <= tests-passed: 3.4.0.beta3

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.