CVE-2025-49845: Discourse Auth Bypass Vulnerability

CVE-2025-49845 Overview

CVE-2025-49845 is an information disclosure vulnerability in Discourse, an open-source discussion platform. The flaw affects the access control logic for posts typed whisper, which are normally restricted to members of groups specified in the whispers_allowed_groups site setting. Users who lose membership in those groups continue to see their own previously authored whisper posts, contrary to the intended visibility model. The issue impacts versions prior to 3.4.6 on the stable branch and versions prior to 3.5.0.beta8-dev on the tests-passed branch. Discourse classified the flaw under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Users removed from whisper-authorized groups retain visibility into their own historical whisper posts, breaking the platform's access control model for staff-only or restricted communications.

Affected Products

Discourse stable branch versions prior to 3.4.6
Discourse tests-passed branch versions prior to 3.5.0.beta8-dev
Self-hosted and managed Discourse deployments relying on whispers_allowed_groups for post segregation

Discovery Timeline

2025-06-25 - CVE-2025-49845 published to NVD
2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-49845

Vulnerability Analysis

Discourse uses post types to differentiate visibility classes. Whisper posts are intended to be visible only to users in groups listed under the whispers_allowed_groups site setting. The access check responsible for filtering whisper posts incorrectly grants visibility to authors of those posts regardless of their current group membership. As a result, a user removed from a whisper-authorized group can still retrieve and view their own previously authored whispers through normal topic browsing.

The vulnerability is network-exploitable and requires no privileges beyond an existing authenticated user account that previously had whisper authoring rights. Exploitation is passive — the offending content remains visible during routine page rendering without any crafted request. Confidentiality impact is limited to the affected user's prior whisper content; integrity and availability are not affected.

Root Cause

The defect resides in the visibility filter applied to whisper posts. The authorization predicate combines group membership checks with an ownership exemption that was not intended to apply to whisper visibility enforcement. When a user's group membership is revoked, the ownership branch continues to return true, bypassing the group-based gate. This is a classic broken access control pattern in which authorization logic conflates resource ownership with permission to view a restricted content class.

Attack Vector

No active exploitation is required. A user who previously belonged to a whisper-authorized group and authored whisper posts will continue to see those posts after group removal by browsing the relevant topics. The attack vector is network-based with low attack complexity. See the Discourse GitHub Security Advisory GHSA-79qw-r73r-69gf for the full vendor description.

Detection Methods for CVE-2025-49845

Indicators of Compromise

Application logs showing whisper post views by user IDs not currently members of any group listed in whispers_allowed_groups
Audit trail entries indicating group membership changes for users who subsequently accessed whisper-typed posts
Database queries returning whisper posts to sessions whose user IDs fail the configured group membership check

Detection Strategies

Cross-reference Discourse post_type=4 (whisper) view events with current group memberships to identify mismatched access
Inspect Rails application logs for topic and post requests rendered to users outside the whispers_allowed_groups configuration
Run periodic SQL audits against the posts and group_users tables to enumerate whisper posts visible to non-authorized users

Monitoring Recommendations

Enable verbose application logging on Discourse instances handling sensitive staff or moderator discussions
Forward Discourse logs to a centralized SIEM or data lake for retention and correlation with identity events
Alert on group membership removal events for users with a history of authoring whisper posts

How to Mitigate CVE-2025-49845

Immediate Actions Required

Upgrade Discourse stable deployments to version 3.4.6 or later
Upgrade Discourse tests-passed deployments to version 3.5.0.beta8-dev or later
Review historical group membership changes and identify users who may have retained visibility into whisper content after revocation
Treat any sensitive content shared via whispers as potentially exposed to former whisper-authorized users

Patch Information

The vulnerability is patched in Discourse 3.4.6 (stable) and 3.5.0.beta8-dev (tests-passed). The fix removes the ownership exemption from the whisper visibility check, ensuring that group membership in whispers_allowed_groups is the sole determinant of access. Refer to the Discourse GitHub Security Advisory GHSA-79qw-r73r-69gf for release notes and commit references.

Workarounds

No vendor-supplied workarounds are available; upgrading is the only supported remediation
As an interim risk reduction, avoid posting sensitive content as whispers until the patched version is deployed
Consider deleting historical whisper posts containing sensitive information if affected users cannot be promptly upgraded

bash

# Upgrade a standard Docker-based Discourse deployment
cd /var/discourse
git pull
./launcher rebuild app

# Verify the running version meets the patched baseline
./launcher logs app | grep -i version