CVE-2025-69218CWE-863

Discourse moderators can access admin-only reports exposing private upload URLs

High · published January 28, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments that moderators should not have access to. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. There is no workaround. Limit moderator privileges to trusted users until the patch is applied.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-01-28T19:30Z
EPSS history
Timeline
  • 28 JAN 19:30Z
    Discourse moderators can access admin-only reports exposing private upload URLs
    cvelistv5