Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments that moderators should not have access to. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. There is no workaround. Limit moderator privileges to trusted users until the patch is applied.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-01-28 | 1 | General1 |
| 2026-01-29 | 1 | General1 |
| 2026-02-02 | 1 | Disclosure1 |
CVE-2025-69218 Unauthorized File URL Access in Discourse Admin Report for Moderators https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-69218
Post summary
The snippet merely announces CVE‑2025‑69218 with a brief descriptive title and no further information on exploitation, patches, or technical details.
A vulnerability (CVE-2025-69218) in Discourse allows moderators to access private upload URLs via admin reports. Review access controls. #Discourse #infosec #Vulnerability https://www.pulsepatch.io/posts/cve-2025-69218-discourse-moderator-private-upload-urls
Post summary
The post announces CVE‑2025‑69218 in Discourse, detailing an access‑control flaw that lets moderators retrieve private upload URLs via admin reports, with no PoC, patch, or exploitation evidence provided.
CVE-2025-69218 Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report … https://www.cve.org/CVERecord?id=CVE-2025-69218
Post summary
The post indicates that moderators in older Discourse versions can access a privileged admin report, but it provides no exploit details, patch information, or evidence of active exploitation.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2025.12.0 | - | - |
| App | discourse | discourse | 2026.1.0 | - | - |