CVE-2025-32376

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
VendorProductVersion
discoursediscourse
𝑥
< 3.4.3
discoursediscourse
1.1.0:beta1
discoursediscourse
1.1.0:beta2
discoursediscourse
1.1.0:beta3
discoursediscourse
1.1.0:beta4
discoursediscourse
1.1.0:beta5
discoursediscourse
1.1.0:beta6
discoursediscourse
1.1.0:beta6b
discoursediscourse
1.1.0:beta7
discoursediscourse
1.1.0:beta8
discoursediscourse
1.2.0:beta1
discoursediscourse
1.2.0:beta2
discoursediscourse
1.2.0:beta3
discoursediscourse
1.2.0:beta4
discoursediscourse
1.2.0:beta5
discoursediscourse
1.2.0:beta6
discoursediscourse
1.2.0:beta7
discoursediscourse
1.2.0:beta8
discoursediscourse
1.2.0:beta9
discoursediscourse
1.3.0:beta1
discoursediscourse
1.3.0:beta10
discoursediscourse
1.3.0:beta11
discoursediscourse
1.3.0:beta2
discoursediscourse
1.3.0:beta3
discoursediscourse
1.3.0:beta4
discoursediscourse
1.3.0:beta5
discoursediscourse
1.3.0:beta6
discoursediscourse
1.3.0:beta7
discoursediscourse
1.3.0:beta8
discoursediscourse
1.3.0:beta9
discoursediscourse
1.4.0:beta1
discoursediscourse
1.4.0:beta10
discoursediscourse
1.4.0:beta11
discoursediscourse
1.4.0:beta12
discoursediscourse
1.4.0:beta2
discoursediscourse
1.4.0:beta3
discoursediscourse
1.4.0:beta4
discoursediscourse
1.4.0:beta5
discoursediscourse
1.4.0:beta6
discoursediscourse
1.4.0:beta7
discoursediscourse
1.4.0:beta8
discoursediscourse
1.4.0:beta9
discoursediscourse
1.5.0:beta1
discoursediscourse
1.5.0:beta10
discoursediscourse
1.5.0:beta11
discoursediscourse
1.5.0:beta12
discoursediscourse
1.5.0:beta13
discoursediscourse
1.5.0:beta13b
discoursediscourse
1.5.0:beta14
discoursediscourse
1.5.0:beta2
discoursediscourse
1.5.0:beta3
discoursediscourse
1.5.0:beta4
discoursediscourse
1.5.0:beta5
discoursediscourse
1.5.0:beta6
discoursediscourse
1.5.0:beta7
discoursediscourse
1.5.0:beta8
discoursediscourse
1.5.0:beta9
discoursediscourse
1.6.0:beta1
discoursediscourse
1.6.0:beta10
discoursediscourse
1.6.0:beta11
discoursediscourse
1.6.0:beta12
discoursediscourse
1.6.0:beta2
discoursediscourse
1.6.0:beta3
discoursediscourse
1.6.0:beta4
discoursediscourse
1.6.0:beta5
discoursediscourse
1.6.0:beta6
discoursediscourse
1.6.0:beta7
discoursediscourse
1.6.0:beta8
discoursediscourse
1.6.0:beta9
discoursediscourse
1.7.0:beta1
discoursediscourse
1.7.0:beta10
discoursediscourse
1.7.0:beta11
discoursediscourse
1.7.0:beta2
discoursediscourse
1.7.0:beta3
discoursediscourse
1.7.0:beta4
discoursediscourse
1.7.0:beta5
discoursediscourse
1.7.0:beta6
discoursediscourse
1.7.0:beta7
discoursediscourse
1.7.0:beta8
discoursediscourse
1.7.0:beta9
discoursediscourse
1.8.0:beta1
discoursediscourse
1.8.0:beta10
discoursediscourse
1.8.0:beta11
discoursediscourse
1.8.0:beta12
discoursediscourse
1.8.0:beta13
discoursediscourse
1.8.0:beta2
discoursediscourse
1.8.0:beta3
discoursediscourse
1.8.0:beta4
discoursediscourse
1.8.0:beta5
discoursediscourse
1.8.0:beta6
discoursediscourse
1.8.0:beta7
discoursediscourse
1.8.0:beta8
discoursediscourse
1.8.0:beta9
discoursediscourse
1.9.0:beta1
discoursediscourse
1.9.0:beta10
discoursediscourse
1.9.0:beta11
discoursediscourse
1.9.0:beta12
discoursediscourse
1.9.0:beta13
discoursediscourse
1.9.0:beta14
discoursediscourse
1.9.0:beta15
discoursediscourse
1.9.0:beta16
discoursediscourse
1.9.0:beta17
discoursediscourse
1.9.0:beta2
discoursediscourse
1.9.0:beta3
discoursediscourse
1.9.0:beta4
discoursediscourse
1.9.0:beta5
discoursediscourse
1.9.0:beta6
discoursediscourse
1.9.0:beta7
discoursediscourse
1.9.0:beta8
discoursediscourse
1.9.0:beta9
discoursediscourse
2.0.0:beta1
discoursediscourse
2.0.0:beta10
discoursediscourse
2.0.0:beta2
discoursediscourse
2.0.0:beta3
discoursediscourse
2.0.0:beta4
discoursediscourse
2.0.0:beta5
discoursediscourse
2.0.0:beta6
discoursediscourse
2.0.0:beta7
discoursediscourse
2.0.0:beta8
discoursediscourse
2.0.0:beta9
discoursediscourse
2.1.0:beta1
discoursediscourse
2.1.0:beta2
discoursediscourse
2.1.0:beta3
discoursediscourse
2.1.0:beta4
discoursediscourse
2.1.0:beta5
discoursediscourse
2.1.0:beta6
discoursediscourse
2.2.0:beta1
discoursediscourse
2.2.0:beta10
discoursediscourse
2.2.0:beta2
discoursediscourse
2.2.0:beta3
discoursediscourse
2.2.0:beta4
discoursediscourse
2.2.0:beta5
discoursediscourse
2.2.0:beta6
discoursediscourse
2.2.0:beta7
discoursediscourse
2.2.0:beta8
discoursediscourse
2.2.0:beta9
discoursediscourse
2.3.0:beta1
discoursediscourse
2.3.0:beta10
discoursediscourse
2.3.0:beta11
discoursediscourse
2.3.0:beta2
discoursediscourse
2.3.0:beta3
discoursediscourse
2.3.0:beta4
discoursediscourse
2.3.0:beta5
discoursediscourse
2.3.0:beta6
discoursediscourse
2.3.0:beta7
discoursediscourse
2.3.0:beta8
discoursediscourse
2.3.0:beta9
discoursediscourse
2.4.0:beta1
discoursediscourse
2.4.0:beta10
discoursediscourse
2.4.0:beta11
discoursediscourse
2.4.0:beta2
discoursediscourse
2.4.0:beta3
discoursediscourse
2.4.0:beta4
discoursediscourse
2.4.0:beta5
discoursediscourse
2.4.0:beta6
discoursediscourse
2.4.0:beta7
discoursediscourse
2.4.0:beta8
discoursediscourse
2.4.0:beta9
discoursediscourse
2.5.0:beta1
discoursediscourse
2.5.0:beta2
discoursediscourse
2.5.0:beta3
discoursediscourse
2.5.0:beta4
discoursediscourse
2.5.0:beta5
discoursediscourse
2.5.0:beta6
discoursediscourse
2.5.0:beta7
discoursediscourse
2.6.0:beta1
discoursediscourse
2.6.0:beta2
discoursediscourse
2.6.0:beta3
discoursediscourse
2.6.0:beta4
discoursediscourse
2.6.0:beta5
discoursediscourse
2.6.0:beta6
discoursediscourse
2.7.0:beta1
discoursediscourse
2.7.0:beta2
discoursediscourse
2.7.0:beta3
discoursediscourse
2.7.0:beta4
discoursediscourse
2.7.0:beta5
discoursediscourse
2.7.0:beta6
discoursediscourse
2.7.0:beta7
discoursediscourse
2.7.0:beta8
discoursediscourse
2.7.0:beta9
discoursediscourse
2.8.0:beta1
discoursediscourse
2.8.0:beta10
discoursediscourse
2.8.0:beta11
discoursediscourse
2.8.0:beta2
discoursediscourse
2.8.0:beta3
discoursediscourse
2.8.0:beta4
discoursediscourse
2.8.0:beta5
discoursediscourse
2.8.0:beta6
discoursediscourse
2.8.0:beta7
discoursediscourse
2.8.0:beta8
discoursediscourse
2.8.0:beta9
discoursediscourse
2.9.0:beta1
discoursediscourse
2.9.0:beta10
discoursediscourse
2.9.0:beta11
discoursediscourse
2.9.0:beta12
discoursediscourse
2.9.0:beta13
discoursediscourse
2.9.0:beta14
discoursediscourse
2.9.0:beta2
discoursediscourse
2.9.0:beta3
discoursediscourse
2.9.0:beta4
discoursediscourse
2.9.0:beta5
discoursediscourse
2.9.0:beta6
discoursediscourse
2.9.0:beta7
discoursediscourse
2.9.0:beta8
discoursediscourse
2.9.0:beta9
discoursediscourse
3.0.0:beta15
discoursediscourse
3.0.0:beta16
discoursediscourse
3.1.0:beta1
discoursediscourse
3.1.0:beta2
discoursediscourse
3.1.0:beta3
discoursediscourse
3.1.0:beta4
discoursediscourse
3.1.0:beta5
discoursediscourse
3.1.0:beta6
discoursediscourse
3.1.0:beta7
discoursediscourse
3.1.0:beta8
discoursediscourse
3.2.0
discoursediscourse
3.2.0:beta1
discoursediscourse
3.2.0:beta2
discoursediscourse
3.2.0:beta3
discoursediscourse
3.2.0:beta4
discoursediscourse
3.3.0:beta1
discoursediscourse
3.3.0:beta2
discoursediscourse
3.3.0:beta3
discoursediscourse
3.3.0:beta4
discoursediscourse
3.3.0:beta5
discoursediscourse
3.3.0:beta6
discoursediscourse
3.4.0:beta1
discoursediscourse
3.4.0:beta2
discoursediscourse
3.4.0:beta3
discoursediscourse
3.4.0:beta4
discoursediscourse
3.5.0:beta1
discoursediscourse
3.5.0:beta2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/discourse/discourse/commit/21a7f3162221c393f9bb13721451aa7f237d881a
https://github.com/discourse/discourse/security/advisories/GHSA-mqqq-h2x3-46fr