CVE-2025-46813: Discourse Information Disclosure Flaw

CVE-2025-46813 Overview

CVE-2025-46813 is an information disclosure vulnerability in Discourse, an open-source community platform. The flaw affects login-required Discourse sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. During this window, content intended only for authenticated members on the site's homepage could be rendered to unauthenticated visitors. The affected window corresponds roughly to April 30, 2025 noon EDT through May 2, 2025 noon EDT. Sites running the stable branch are not affected. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Private homepage content on login-required Discourse instances could be exposed to unauthenticated users over the network without any user interaction or authentication.

Affected Products

Discourse 3.5.0.beta1
Discourse 3.5.0.beta2
Discourse 3.5.0.beta3
Discourse 3.5.0.beta4 builds prior to commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b

Discovery Timeline

2025-05-05 - CVE-2025-46813 published to NVD
2025-09-26 - Last updated in NVD database

Technical Details for CVE-2025-46813

Vulnerability Analysis

Discourse supports a "login-required" mode where unauthenticated visitors are redirected to a login screen rather than viewing community content. A development change introduced in commit 10df7fdee060d44accdee7679d66d778d1136510 (titled "DEV: Show login-required screen in root route") modified the homepage router so that the login-required screen would render at the root route. The change altered the route-matching logic in app/assets/javascripts/discourse/app/lib/homepage-router-overrides.js and added a LoginRequiredController in app/assets/javascripts/discourse/app/controllers/discovery/login-required.js.

As a side effect, the homepage controller could resolve and emit homepage data to clients that had not authenticated. Private categories, topics, or other content surfaced through the homepage feed could therefore be transmitted to unauthenticated browsers on affected deployments.

Root Cause

The root cause is a broken access control regression introduced when the login-required gate was relocated into the root route. The intent URL check was expanded to accept /login-required as a permitted homepage destination, which allowed the homepage controller to load and serialize content before the unauthenticated session was rejected. Because the access gate ran after the homepage data resolved, sensitive content leaked into responses returned to anonymous clients.

Attack Vector

Exploitation requires no privileges and no user interaction. A remote, unauthenticated attacker simply requests the root path of an affected login-required Discourse instance over the network. The server returns homepage content that should be restricted to logged-in members, exposing topic titles, excerpts, or category data depending on site configuration.

javascript

// Patch in app/assets/javascripts/discourse/app/lib/homepage-router-overrides.js
// Revert removes the "/login-required" branch that allowed the homepage
// route to resolve for unauthenticated visitors.
   const intentUrl = transition?.intent?.url;
   if (
     intentUrl?.startsWith(homepageDestination()) ||
-    intentUrl?.startsWith("/login-required") ||
     (transition?.intent.name === `discovery.${defaultHomepage()}` &&
       transition?.intent.queryParams[homepageRewriteParam])
   ) {

Source: Discourse commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b

Detection Methods for CVE-2025-46813

Indicators of Compromise

Unauthenticated HTTP GET requests to / or /login-required on a login-required Discourse instance returning homepage JSON payloads containing topic or category data.
Web server access logs showing successful 200 OK responses to anonymous clients on routes that should redirect to authentication.
Discourse application logs recording homepage controller execution for sessions without an associated user ID during the April 30 – May 2, 2025 deployment window.

Detection Strategies

Audit the deployed Discourse commit hash and confirm it falls outside the vulnerable range between 10df7fdee06 and 82d84af6b0e.
Replay an unauthenticated request against staging using curl https://<site>/ and inspect the response for content that should require login.
Correlate CDN or reverse proxy logs against authentication logs to identify anonymous sessions that received non-redirect responses on the root route.

Monitoring Recommendations

Alert on anonymous responses larger than the expected login redirect size for the root path on login-required Discourse hosts.
Monitor for unusual outbound crawler traffic that may indicate scraping of leaked homepage content during the vulnerable window.
Track changes to the Discourse tests-passed branch in deployment pipelines and gate production rollouts on review of security advisories.

How to Mitigate CVE-2025-46813

Immediate Actions Required

Upgrade Discourse to a build that includes commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b or later, or switch to the stable branch.
Verify the login_required site setting still redirects anonymous traffic by issuing an unauthenticated request to the root URL after upgrade.
Rotate or restrict any sensitive content that may have been indexed by search engines or scraped while the deployment was vulnerable.

Patch Information

The issue is resolved in Discourse 3.5.0.beta4 builds that include commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b, which reverts the prior change introduced in commit 10df7fdee060d44accdee7679d66d778d1136510. Sites running the stable branch were never affected. Details are published in the Discourse GHSA-v3h7-c287-pfg9 advisory.

Workarounds

No workarounds are available. The Discourse security advisory states that affected sites must upgrade to a non-vulnerable version.
Operators who cannot upgrade immediately should consider taking the instance offline or placing it behind an authenticating reverse proxy until the patch is applied.

bash

# Verify the deployed Discourse commit is not in the vulnerable range
cd /var/discourse
sudo ./launcher enter app
cd /var/www/discourse
git log -1 --format="%H %s"
# Confirm the hash is at or after 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b
# then rebuild the container if an upgrade is required
exit
sudo ./launcher rebuild app