CVE-2025-32376: Discourse DM User Limit Bypass Vulnerability
Summary
CVE-2025-32376: Discourse DM limits aren’t always properly enforced. Affects discourse versions < 3.4.3. Fixed in 3.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Discourse is an open-source discussion platform designed for creating and managing online communities. It offers features such as threaded discussions, private messaging, and user management. However, prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, a vulnerability existed that allowed users to bypass the limit on direct messages (DMs), potentially enabling them to create a DM that included every user on the site.
Vulnerability Detail
The vulnerability arises from improper validation of user limits for direct messages within Discourse. This flaw allows an attacker to bypass the restrictions set on the number of users that can be included in a DM. As a result, an attacker could potentially send a DM to all users on the platform, leading to privacy concerns and spam issues. The vulnerability has been assigned the identifier CVE-2025-32376 and is classified with a medium severity level.
How To Fix
Minimum fixed version
3.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. It is highly recommended to update to the latest version as soon as possible.
Conclusion
The CVE-2025-32376 vulnerability in Discourse poses a significant risk by allowing users to bypass DM limits. It is essential for users to update to the latest patched versions to protect against potential exploitation. Regular monitoring and updating of software can help maintain security.
See every vulnerability recorded for discourse →
FAQ
CVE-2025-32376 is a vulnerability in Discourse that allows users to bypass the limit on direct messages, potentially enabling them to send messages to all users on the platform.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Versions prior to 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch are affected by this vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating your installation to mitigate the risk associated with this vulnerability.
The vulnerability could lead to privacy violations and spam, as an attacker could send unsolicited messages to all users on the platform.
References
Related vulnerabilities
Recent vulnerabilities recorded for discourse.
