CVE-2025-24972: Discourse may bypass user preference when adding users to chat groups
Discourse is an open-source discussion platform. Prior to versions 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions 3.3.4 and 3.4.0.beta5 contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24972?
CVE-2025-24972 is classified as a medium severity vulnerability.
How do I fix CVE-2025-24972?
To fix CVE-2025-24972, upgrade Discourse to version 3.3.4 or higher on the stable branch or 3.4.0.beta5 on the beta branch.
What impact does CVE-2025-24972 have on users?
CVE-2025-24972 allows users to be added to group direct messages despite their preference to disable direct messaging, potentially compromising user privacy.
Which versions of Discourse are affected by CVE-2025-24972?
CVE-2025-24972 affects Discourse versions prior to 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch.
How does CVE-2025-24972 affect group direct messaging?
CVE-2025-24972 enables users to receive invitations to group direct messages even when they have disabled direct messaging in their settings.