CVE-2025-68479
Last modified
CVE-2025-68479 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Discourse | Discourse | < 3.5.4 |
| Discourse | Discourse | >= 2025.11.0, < 2025.11.2 |
| Discourse | Discourse | 2025.12.0 |
| Discourse | Discourse | 2026.1.0 |
References
- https://github.com/discourse/discourse/security/advisories/GHSA-6gjr-5897-m327Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-68479?
How severe is CVE-2025-68479?
How do I fix CVE-2025-68479?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-68473ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.6
- CVE-2025-68474ESF-IDF is the Espressif Internet of Things (IOT) Developmen…7.6
- CVE-2025-68475Fedify is a TypeScript library for building federated server…7.5
- CVE-2025-68476KEDA is a Kubernetes-based Event Driven Autoscaling componen…8.2
- CVE-2025-68477Langflow is a tool for building and deploying AI-powered age…6.5
- CVE-2025-68478Langflow is a tool for building and deploying AI-powered age…7.1
- CVE-2025-6848A vulnerability, which was classified as critical, has been …8.8
- CVE-2025-68480Marshmallow is a lightweight library for converting complex …5.3
- CVE-2025-68481FastAPI Users allows users to quickly add a registration and…8.8
- CVE-2025-68482A improper certificate validation vulnerability in Fortinet …5.9
- CVE-2025-68483Rejected reason: Not used
- CVE-2025-68484Rejected reason: Not used
Are you affected by CVE-2025-68479?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST