Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the "require_change_email_confirmation" setting.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2025-69289 Discourse Privilege Escalation Vulnerability Allows Non-Admin Account Takeover https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-69289
Post summary
The text announces CVE‑2025‑69289 as a new privilege escalation flaw in Discourse that permits a non‑admin user to take over an account.
CVE-2025-69289 Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admi… https://www.cve.org/CVERecord?id=CVE-2025-69289
Post summary
CVE‑2025‑69289 is a privilege escalation vulnerability affecting Discourse versions before 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2025.12.0 | - | - |
| App | discourse | discourse | 2026.1.0 | - | - |