Information Disclosure Vulnerability in Discourse by Discourse

CVE-2025-49845

What is CVE-2025-49845?

Discourse, the popular open-source discussion platform, has an information disclosure vulnerability affecting users in specific versions. The platform's 'whisper' feature allows for selective visibility, controlled by the 'whispers_allowed_groups' setting. However, users on versions prior to 3.4.6 (stable branch) and prior to 3.5.0.beta8-dev (tests-passed branch) can still access their own whispers despite losing permission to view them. This undermines the integrity of the visibility controls designed to protect sensitive discussions. Users are advised to update to versions containing the fix as no workarounds are available.

References