CVE-2025-32376
MEDIUMDescription
Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.
Is your site exposed to CVE-2025-32376?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
4.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Type (CWE)
CWE-284
CWE-284
Affected Products
| Vendor | Product |
|---|---|
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
| discourse | discourse |
References
Frequently Asked Questions
What is CVE-2025-32376? +
Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3. It has a CVSS v3.1 base score of 4.3 (MEDIUM).
How severe is CVE-2025-32376? +
CVE-2025-32376 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2025-32376? +
CVE-2025-32376 affects products from discourse, specifically: discourse. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-32376? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.
Related Vulnerabilities
CVE-2026-35402
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode …
CVE-2026-40866
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …
CVE-2026-40865
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …
CVE-2026-40874
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes …
CVE-2026-54533
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms …
CVE-2026-48907
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately …