CVE-2025-24808

Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in service to wrap part of the `add_users_to_channel` service inside a distributed lock/mutex in order to avoid the race condition.

• CWE-362

• https://github.com/discourse/discourse/commit/a16b2f224860f6678f89f5ffa012f0ede17e4095Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-hfcx-qjw6-573rVendor Advisory

Published

Mar 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24802Plonky2 is a SNARK implementation based on techniques from P…8.6
• CVE-2025-24803Mobile Security Framework (MobSF) is an automated, all-in-on…5.4
• CVE-2025-24804Mobile Security Framework (MobSF) is an automated, all-in-on…4.3
• CVE-2025-24805Mobile Security Framework (MobSF) is an automated, all-in-on…5.5
• CVE-2025-24806Authelia is an open-source authentication and authorization …2.3
• CVE-2025-24807eprosima Fast DDS is a C++ implementation of the DDS (Data D…7.1
• CVE-2025-2481The MediaView plugin for WordPress is vulnerable to Reflecte…6.1
• CVE-2025-24810Cross-site scripting vulnerability exists in Simple Image Si…4.8
• CVE-2025-24811A vulnerability has been identified in SIMATIC S7-1200 CPU 1…8.7
• CVE-2025-24812A vulnerability has been identified in SIMATIC S7-1200 CPU 1…7.1
• CVE-2025-24813Path Equivalence: 'file.Name' (Internal Dot) leading to Remo…9.8
• CVE-2025-24814Core creation allows users to replace "trusted" configset fi…5.5