CVE-2025-24972

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.3.4 Discourse versions prior to 3.4.0.beta5

Description The issue affects Discourse, an open-source discussion platform, where users could be added to group direct messages despite disabling direct messaging in their preferences under specific circumstances.

Recommendations For versions prior to 3.3.4, update to version 3.3.4 or later to resolve the issue. For versions prior to 3.4.0.beta5, update to version 3.4.0.beta5 or later to resolve the issue. As a temporary workaround, consider disabling chat in user preferences to prevent being added to new group chats.