CVE-2025-32376: Discourse User Limit Bypass Vulnerability

CVE-2025-32376 Overview

CVE-2025-32376 is a broken access control vulnerability [CWE-284] affecting Discourse, an open-source discussion platform. The flaw allows an authenticated user to bypass the configured user limit for a direct message (DM), potentially enabling the creation of a DM that includes every user on a site. The issue exists in the chat component's add_users_to_channel service, where the model validated only the presence of usernames or groups without enforcing the chat_max_direct_message_users site setting on the usernames array. Discourse maintainers addressed the flaw in stable version 3.4.3 and beta version 3.5.0.beta3.

Critical Impact
An authenticated user can bypass the DM participant cap and add an arbitrary number of users to a direct message, enabling site-wide unsolicited messaging and potential abuse of chat notifications.

Affected Products

Discourse stable branch prior to 3.4.3
Discourse beta branch prior to 3.5.0.beta3
Discourse chat plugin (plugins/chat/app/services/chat/add_users_to_channel.rb)

Discovery Timeline

2025-04-30 - CVE-2025-32376 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32376

Vulnerability Analysis

The vulnerability resides in the Discourse chat plugin's contract for adding users to a channel. The prior contract required only that either usernames or groups be present, using a target_presence validator. It did not enforce the chat_max_direct_message_users site setting against the usernames collection. As a result, an authenticated user with permission to initiate a DM could submit a usernames array of arbitrary length and add every account on the site to a single direct message.

The consequences are limited to integrity and availability of the chat surface. There is no direct impact on confidentiality of stored data, but the flaw enables broadcast-style unsolicited messaging, notification flooding, and potential abuse for phishing or spam campaigns targeting the entire user base of a Discourse instance.

Root Cause

The root cause is missing input length validation in the chat contract. The contract validated presence but not the maximum size of usernames, so the server-side enforcement of SiteSetting.chat_max_direct_message_users was absent when users were added via this service path.

Attack Vector

Exploitation requires network access to the Discourse instance and low-privileged authenticated access with the ability to create or add users to a direct message channel. User interaction is required from targeted recipients only to the extent that they receive the DM. The attacker crafts a request to the chat channel service supplying a usernames array that exceeds the configured DM user limit.

ruby

       attribute :channel_id, :integer
 
       validates :channel_id, presence: true
-      validate :target_presence
-
-      def target_presence
-        usernames.present? || groups.present?
-      end
+      validates :usernames, presence: true, if: -> { groups.blank? }
+      validates :usernames,
+                length: {
+                  maximum: SiteSetting.chat_max_direct_message_users,
+                },
+                allow_blank: true
+      validates :groups, presence: true, if: -> { usernames.blank? }
     end
 
     lock(:channel_id) do

Source: Discourse commit 21a7f31. The patch replaces the presence-only target_presence custom validator with explicit validates calls that enforce a maximum length on usernames equal to SiteSetting.chat_max_direct_message_users.

Detection Methods for CVE-2025-32376

Indicators of Compromise

Direct message channels containing a number of participants greater than the value configured in chat_max_direct_message_users.
Unusually large usernames arrays in HTTP requests to the chat channel add-users endpoint.
Sudden spikes in chat notifications delivered to a broad cross-section of the user base.

Detection Strategies

Query the chat database for direct message channels whose participant count exceeds the configured site setting to identify historical abuse.
Inspect Rails and reverse-proxy access logs for POST requests to chat channel endpoints containing oversized usernames payloads.
Correlate account creation, DM creation, and mass-notification events on the same session or IP address to identify abuse patterns.

Monitoring Recommendations

Enable and retain application-level logging for the Discourse chat plugin, focusing on channel membership changes.
Alert on any DM channel whose membership exceeds the chat_max_direct_message_users threshold.
Monitor outbound notification volume per originating user and flag statistical outliers.

How to Mitigate CVE-2025-32376

Immediate Actions Required

Upgrade Discourse to stable 3.4.3 or beta 3.5.0.beta3 or later without delay.
Audit existing DM channels for participant counts that exceed the configured chat limit and remove or archive abusive channels.
Review chat-related audit logs from prior to the upgrade for evidence of exploitation.

Patch Information

The fix is delivered in Discourse commit 21a7f31 and detailed in GitHub Security Advisory GHSA-mqqq-h2x3-46fr. The patched contract enforces SiteSetting.chat_max_direct_message_users as a hard maximum on the usernames collection when adding users to a chat channel.

Workarounds

If patching cannot be performed immediately, temporarily disable the chat plugin on affected Discourse instances.
Restrict the trust level or group membership permitted to create direct messages until the upgrade is applied.
Set chat_max_direct_message_users to a low value and monitor for channels exceeding that value as a compensating control until upgrade.

bash

# Upgrade a standard Discourse Docker deployment to the patched stable release
cd /var/discourse
git pull
./launcher rebuild app
# Verify the running version is 3.4.3 or later (or 3.5.0.beta3+ on the beta branch)
./launcher logs app | grep -i "discourse version"