CVE-2025-68933

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites that grant moderators post ownership transfer permissions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The patch adds visibility checks for both the topic and posts before allowing ownership transfer. As a workaround, disable the `moderators_change_post_ownership` site setting to prevent non-admin moderators from using the post ownership transfer feature.

• CWE-863

• https://github.com/discourse/discourse/security/advisories/GHSA-hpxv-mw7v-fqg2Mitigation, Third Party Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68928Frappe CRM is an open-source customer relationship managemen…5.4
• CVE-2025-68929Frappe is a full-stack web application framework. Prior to v…9
• CVE-2025-6893An Execution with Unnecessary Privileges vulnerability has b…9.3
• CVE-2025-68930Versions of the Traccar open-source GPS tracking system up t…6.5
• CVE-2025-68931Jervis is a library for Job DSL plugin scripts and shared Je…7.5
• CVE-2025-68932FreshRSS is a free, self-hostable RSS aggregator. Prior to v…9.8
• CVE-2025-68934Discourse is an open source discussion platform. In versions…6.5
• CVE-2025-68935ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field f…6.1
• CVE-2025-68936ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme …6.1
• CVE-2025-68937Forgejo before 13.0.2 allows attackers to write to unintende…9.5
• CVE-2025-68938Gitea before 1.25.2 mishandles authorization for deletion of…5.3
• CVE-2025-68939Gitea before 1.23.0 allows attackers to add attachments with…5.3