CVE-2025-24972: Discourse Auth Bypass Vulnerability

CVE-2025-24972 Overview

CVE-2025-24972 affects Discourse, an open-source discussion platform. The vulnerability allows users to be added to group direct messages even when they have disabled direct messaging in their account preferences. The issue exists in Discourse versions prior to 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch. The flaw stems from missing authorization checks ([CWE-862]) when processing group direct message invitations. Attackers with authenticated access can bypass user privacy preferences to deliver unwanted messages to targeted accounts.

Critical Impact

Authenticated users can circumvent recipient direct-message preferences, undermining user privacy controls and potentially enabling harassment or unsolicited messaging within Discourse communities.

Affected Products

• Discourse stable branch versions prior to 3.3.4
• Discourse beta branch versions 3.4.0.beta1 through 3.4.0.beta4
• Discourse beta branch versions prior to 3.4.0.beta5

Discovery Timeline

• 2025-03-26 - CVE-2025-24972 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24972

Vulnerability Analysis

The vulnerability is a missing authorization flaw in Discourse's group direct messaging feature. When a user disables direct messages in their preferences, the platform is expected to prevent that user from being added to new direct message threads. In affected versions, the enforcement path fails under specific conditions when the message is delivered through a group direct message rather than a one-to-one direct message. The result is that a user's messaging preference is silently ignored during group invitation processing. Impact is limited to integrity of user preferences; confidentiality and availability are not directly affected. The vulnerability requires an authenticated account, which limits opportunistic exploitation but keeps community moderators and members exposed to insider misuse.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in the code path that adds recipients to group direct message conversations. The preference toggle that governs direct message acceptance is not consulted when the invitation originates from a group message workflow. Chat preferences follow a separate enforcement path that correctly blocks additions to new group chats, which is why the chat-disable workaround is effective.

Attack Vector

Exploitation requires an authenticated Discourse account with permission to initiate group direct messages. The attacker creates a group direct message and adds the target user as a participant. Because the preference check is skipped along this code path, the target receives the message even though direct messaging is disabled in their account settings. No user interaction from the target is required for delivery.

No public proof-of-concept exploit code is available for this issue. Refer to the GitHub Security Advisory GHSA-4p63-qw6g-4mv2 for vendor-supplied technical detail.

Detection Methods for CVE-2025-24972

Indicators of Compromise

• Group direct message threads containing recipients whose account preferences show direct messaging disabled.
• User reports of receiving group direct messages after opting out of direct messages in preferences.
• Audit log entries showing message recipient additions that do not align with recipient preference state.

Detection Strategies

• Query the Discourse database for users with direct messaging disabled who appear as participants in group direct message topics created before patching.
• Review application logs for group message creation events and correlate participant lists against user preference tables.
• Monitor moderation and abuse reports for patterns of unwanted group direct messages tied to specific senders.

Monitoring Recommendations

• Track Discourse version strings in HTTP responses to identify instances still running versions prior to 3.3.4 or 3.4.0.beta5.
• Alert on spikes in group direct message creation from single accounts, which can indicate abuse of the flaw.
• Include the affected Discourse versions in vulnerability scanning coverage for internet-facing community platforms.

How to Mitigate CVE-2025-24972

Immediate Actions Required

• Upgrade Discourse to version 3.3.4 on the stable branch or 3.4.0.beta5 on the beta branch.
• Inventory all Discourse deployments, including staging and community instances, and confirm the running version.
• Review recent group direct message activity for signs of preference bypass abuse and take moderation action as needed.

Patch Information

Discourse released fixed versions 3.3.4 (stable) and 3.4.0.beta5 (beta) that enforce the direct message preference check when adding recipients to group direct messages. Details are published in the Discourse GitHub Security Advisory GHSA-4p63-qw6g-4mv2.

Workarounds

• Instruct affected users to disable chat in their preferences, which prevents them from being added to new group chats per vendor guidance.
• Restrict which trust levels or groups can initiate group direct messages using Discourse site settings.
• Increase moderator visibility over group direct message creation until the patch is deployed.

# Verify installed Discourse version
cd /var/discourse
./launcher enter app
cat /var/www/discourse/VERSION

# Rebuild the container after updating to a patched release
exit
./launcher rebuild app