CVE-2025-68933

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites that grant moderators post ownership transfer permissions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The patch adds visibility checks for both the topic and posts before allowing ownership transfer. As a workaround, disable the `moderators_change_post_ownership` site setting to prevent non-admin moderators from using the post ownership transfer feature.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-689346.5Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can sub CVE-2025-689356.1ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.CVE-2025-689366.1ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.CVE-2025-689379.5Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-CVE-2025-689385.3Gitea before 1.25.2 mishandles authorization for deletion of releases.CVE-2025-689395.3Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.CVE-2025-68945.3An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the CVE-2025-689405.3In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.CVE-2025-689415.3Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.CVE-2025-689425.4Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.CVE-2025-689435.3Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.CVE-2025-689445.3Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.