CVE-2025-32376

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
discourse	discourse	< 3.4.3; >= 3.5.0.beta1, < 3.5.0.beta3

References

Timeline

Published: Apr 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-323776.5Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerabi CVE-2025-323785.3Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mas CVE-2025-323796.1Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to CVE-2025-32389.8A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. Affected is an unknown function of the CVE-2025-323807.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-323816.5XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache f CVE-2025-323821.8Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (e CVE-2025-323837.2MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmente CVE-2025-323856.5EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbi CVE-2025-323866.5Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed CVE-2025-323876.5Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of referenc CVE-2025-323885.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param