Discourse 3.4.0 Beta 3
Approved changes feed: RSS · Atom
cpe:2.3:a:discourse:discourse:3.4.0:beta3:*:*:beta:*:*:*
part: a version: 3.4.0 update: beta3
| Vendor | Discourse (2d3c125b-857a-5933-b846-ed7f9d5e0225) |
|---|---|
| Product | Discourse (4347364d-ae10-5ab6-a9ec-6e7dcaf78dd8) |
| Edition | * |
| Language | * |
| Software edition | beta |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/discourse/discourse |
purl2cpe | 2026-06-01 10:13:03.611400 |
pkg:rpm/opensuse/discourse |
purl2cpe | 2026-06-01 10:13:03.611402 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-32376 |
vulnerable | 2026-06-08 07:18:59.685007 |
Discourse DM limits aren’t always properly enforced
Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.
Published: 2025-04-30T14:55:21.473Z
Updated: 2025-04-30T15:08:52.268Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24972 |
vulnerable | 2026-06-08 07:12:50.229359 |
Discourse may bypass user preference when adding users to chat groups
MEDIUM (4.3)
Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.
Published: 2025-03-26T14:15:13.164Z
Updated: 2025-03-26T18:25:38.709Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24808 |
vulnerable | 2026-06-08 07:12:49.929688 |
Discourse has race condition when adding users to a group DM
MEDIUM (4.3)
Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in service to wrap part of the `add_users_to_channel` service inside a distributed lock/mutex in order to avoid the race condition.
Published: 2025-03-26T14:08:38.915Z
Updated: 2025-03-26T18:26:18.555Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22602 |
vulnerable | 2026-06-08 07:10:53.481791 |
Stored DOM-based XSS (without CSP) via video placeholders in Discourse
MEDIUM (6.5)
Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.
Published: 2025-02-04T20:51:56.909Z
Updated: 2025-02-12T14:03:25.855Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22601 |
vulnerable | 2026-06-08 07:10:53.479492 |
Client Side Path Traversal using activate account route in Discourse
LOW (3.1)
Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2025-02-04T20:53:11.983Z
Updated: 2025-02-11T21:32:19.520Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56328 |
vulnerable | 2026-06-08 06:54:17.724823 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56197 |
vulnerable | 2026-06-08 06:54:17.521661 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53994 |
vulnerable | 2026-06-08 06:54:15.822305 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53991 |
vulnerable | 2026-06-08 06:54:15.819100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53851 |
vulnerable | 2026-06-08 06:54:15.630919 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53266 |
vulnerable | 2026-06-08 06:54:14.880286 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52794 |
vulnerable | 2026-06-08 06:52:16.248900 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-49765 |
vulnerable | 2026-06-08 06:50:14.645775 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.