CVE-2025-69289

Опубликовано: 28 янв. 2026

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the "require_change_email_confirmation" setting.

Ссылки

https://github.com/discourse/discourse/security/advisories/GHSA-p39j-x54c-rwqq
Third Party Advisory
Mitigation

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*

Версия до 3.5.4 (исключая)

cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*

Версия от 2025.11.0 (включая) до 2025.11.2 (исключая)

cpe:2.3:a:discourse:discourse:2025.12.0:*:*:*:stable:*:*:*

cpe:2.3:a:discourse:discourse:2026.1.0:*:*:*:stable:*:*:*

EPSS

Процентиль: 8%

0.0003

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-863