Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. To work around this problem, a site admin can temporarily revoke the moderation role from all moderators until the Discourse instance has been upgraded to a version that has been patched.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2025-68666 Discourse Privilege Escalation Vulnerability Exposes Private User Archives https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-68666
Post summary
The post announces a privilege‑escalation vulnerability (CVE-2025-68666) in Discourse that can expose private user archives; no PoC, exploit, patch, or active exploitation details are mentioned.
CVE-2025-68666 Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation … https://www.cve.org/CVERecord?id=CVE-2025-68666
Post summary
Discourse versions older than 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allow moderators to view user archives, exposing a privacy breach. No PoC, exploit code, active exploitation, or patch details are provided.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2025.12.0 | - | - |
| App | discourse | discourse | 2026.1.0 | - | - |