CVE-2025-68666CWE-863

Discourse users archives leaked to users with moderation privileges

Medium · published January 28, 2026

CVSS v4.0
5.9
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. To work around this problem, a site admin can temporarily revoke the moderation role from all moderators until the Discourse instance has been upgraded to a version that has been patched.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-01-28T19:14Z
EPSS history
Timeline
  • 28 JAN 19:14Z
    Discourse users archives leaked to users with moderation privileges
    cvelistv5