Bypass Vulnerability in Discourse Open-Source Discussion Platform

CVE-2025-32376

What is CVE-2025-32376?

The Discourse platform has a security vulnerability that allows users to bypass the limits set for direct messages (DMs). This flaw enables a user to attempt to create a DM that includes every user on the site, potentially leading to privacy and security concerns. The vulnerability affects versions prior to 3.4.3 for the stable branch and 3.5.0.beta3 for the beta branch. Users are advised to upgrade to the patched versions to safeguard against this issue. Detailed information can be found in the security advisories linked in the references.

References