Race Condition Vulnerability in Discourse Open-Source Discussion Platform

CVE-2025-24808

What is CVE-2025-24808?

Discourse, an open-source discussion platform, contains a vulnerability that allows users to exploit a race condition when approaching the limit of users in a group direct message (DM). Attackers can send parallel requests to add new users, potentially exceeding the established limits. This flaw was addressed in versions 3.3.4 and 3.4.0.beta5, which integrated a locking mechanism within the 'add_users_to_channel' service to mitigate the issue effectively.

References