{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*",
              "matchCriteriaId": "07E7B04F-B033-48BB-AA28-8C38BE2D7334",
              "versionEndExcluding": "3.3.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*",
              "matchCriteriaId": "B70F4653-EB23-49AB-AF71-C39E5B6D5E5F",
              "versionEndExcluding": "3.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*",
              "matchCriteriaId": "AF6D8860-8764-4EEF-9FDD-89FF932791A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta2:*:*:beta:*:*:*",
              "matchCriteriaId": "6A7FC47A-8C19-4E39-B0CF-ADA835A02A9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta3:*:*:beta:*:*:*",
              "matchCriteriaId": "8802773F-8216-4F0F-9F58-89056BFBE8B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta4:*:*:beta:*:*:*",
              "matchCriteriaId": "C6414144-DB59-412A-96A2-4405A25356A8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de las versiones 3.3.4 de la rama estable y 3.4.0.beta5 de la rama beta, en circunstancias espec\u00edficas, se pod\u00eda a\u00f1adir usuarios a mensajes directos de grupo a pesar de tener la opci\u00f3n deshabilitada en sus preferencias. Las versiones 3.3.4 y 3.4.0.beta5 incluyen un parche para este problema. Existe un workaround. Si un usuario deshabilita el chat en sus preferencias, no podr\u00e1 a\u00f1adirse a nuevos chats de grupo."
    }
  ],
  "id": "CVE-2025-24972",
  "lastModified": "2025-08-25T17:06:08.770",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-26T15:16:07.920",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-4p63-qw6g-4mv2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}