Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2025-32376

Discourse DM limits aren’t always properly enforced

Description

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • < 3.4.3affected
  • >= 3.5.0.beta1, < 3.5.0.beta3affected

References