Skip to content
CVE PROGRAM SOURCE RECORD3.5 Low

CVE-2025-47288

Discourse Policy plugin private group members visible

Description

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1. A workaround involves moving any policy topics with private groups to restricted categories.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse-policy

  • < 0.1.1affected

References