CVE Explorer
CVE-2025-68666
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. To work around this problem, a site admin can temporarily revoke t
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"discourse","vendor":"discourse","versions":[{"status":"affected","version":"< 3.5.4"},{"status":"affected","version":">= 2025.11.0-latest, < 2025.11.2"},{"status":"affected","version":">= 2025.12.0-latest, < 2025.12.1"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3637997ffb1cbdeeb3f7f82fb6e17d000b94587661d9ce3dfb762d1ea3e51563 · sha256:5f73e8fbc7dcee79… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":5.9,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3637997ffb1cbdeeb3f7f82fb6e17d000b94587661d9ce3dfb762d1ea3e51563 · sha256:5f73e8fbc7dcee79… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3637997ffb1cbdeeb3f7f82fb6e17d000b94587661d9ce3dfb762d1ea3e51563 · sha256:5f73e8fbc7dcee79… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/discourse/discourse/security/advisories/GHSA-xmvw-jjqq-25mv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/discourse/discourse/security/advisories/GHSA-xmvw-jjqq-25mv"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3637997ffb1cbdeeb3f7f82fb6e17d000b94587661d9ce3dfb762d1ea3e51563 · sha256:5f73e8fbc7dcee79… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.