CVE-2025-46813

Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content on the site's homepage could be visible to unauthenticated users. Only login-required sites that got deployed during this timeframe are affected, roughly between April 30 2025 noon EDT and May 2 2025, noon EDT. Sites on the stable branch are unaffected. Private content on an instance's homepage could be visible to unauthenticated users on login-required sites. Versions of 3.5.0.beta4 after commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b are not vulnerable to the issue. No workarounds are available. Sites must upgrade to a non-vulnerable version of Discourse.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/discourse/discourse/commit/10df7fdee060d44accdee7679d66d778d1136510	Patch
https://github.com/discourse/discourse/commit/82d84af6b0efbd9fa2aeec3e91ce7be1a768511b	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta1:::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta2:::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta3:::beta:::*

History

No history.

Information

Published : 2025-05-05 20:15

Updated : 2025-09-26 12:54

NVD link : CVE-2025-46813

Mitre link : CVE-2025-46813

CVE.ORG link : CVE-2025-46813

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2025-46813", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-05-05T20:15:21.753", "references": [{"url": "https://github.com/discourse/discourse/commit/10df7fdee060d44accdee7679d66d778d1136510", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/discourse/discourse/commit/82d84af6b0efbd9fa2aeec3e91ce7be1a768511b", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content on the site's homepage could be visible to unauthenticated users. Only login-required sites that got deployed during this timeframe are affected, roughly between April 30 2025 noon EDT and May 2 2025, noon EDT. Sites on the stable branch are unaffected. Private content on an instance's homepage could be visible to unauthenticated users on login-required sites. Versions of 3.5.0.beta4 after commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b are not vulnerable to the issue. No workarounds are available. Sites must upgrade to a non-vulnerable version of Discourse."}, {"lang": "es", "value": "Discourse es una plataforma comunitaria de c\u00f3digo abierto. Una vulnerabilidad de fuga de datos afecta a los sitios implementados entre los commits 10df7fdee060d44accdee7679d66d778d1136510 y 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. En los sitios que requieren inicio de sesi\u00f3n, la fuga de datos provoc\u00f3 que parte del contenido de la p\u00e1gina principal del sitio fuera visible para usuarios no autenticados. Solo los sitios que requieren inicio de sesi\u00f3n implementados durante este periodo se vieron afectados, aproximadamente entre el 30 de abril de 2025 al mediod\u00eda EDT y el 2 de mayo de 2025 al mediod\u00eda EDT. Los sitios de la rama estable no se vieron afectados. El contenido privado de la p\u00e1gina principal de una instancia podr\u00eda ser visible para usuarios no autenticados en sitios que requieren inicio de sesi\u00f3n. Las versiones de 3.5.0.beta4 posteriores a la confirmaci\u00f3n 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b no son vulnerables al problema. No hay workarounds disponibles. Los sitios deben actualizar a una versi\u00f3n de Discourse no vulnerable."}], "lastModified": "2025-09-26T12:54:49.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "A0A6583A-A8AE-4C05-8947-79A0E4A73E1D", "versionEndExcluding": "3.5.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "66931995-F794-48F0-9DBB-9048B6C9D8DD"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "B0461B93-273C-4305-80F9-C70A100B4DFE"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "F1596D4E-FD8B-4443-AAAE-1D4AC6B1CE6D"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}