CVE-2025-68933: Discourse Auth Bypass Vulnerability

CVE-2025-68933 Overview

CVE-2025-68933 is a Broken Access Control vulnerability affecting Discourse, an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the moderators_change_post_ownership setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This vulnerability allows moderators to bypass intended access restrictions and gain unauthorized access to sensitive communications.

Critical Impact

Non-admin moderators can access and exfiltrate private messages and restricted category content by exploiting the post ownership transfer feature, bypassing access control mechanisms intended to protect sensitive discussions.

Affected Products

• Discourse versions prior to 3.5.4
• Discourse versions prior to 2025.11.2
• Discourse versions prior to 2025.12.1
• Discourse versions prior to 2026.1.0

Discovery Timeline

• 2026-01-28 - CVE CVE-2025-68933 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-68933

Vulnerability Analysis

This vulnerability stems from a Broken Access Control flaw (CWE-863: Incorrect Authorization) in the Discourse platform's post ownership transfer functionality. The core issue is that the application fails to verify whether a moderator has visibility permissions for a topic or its posts before allowing ownership transfer operations.

When the moderators_change_post_ownership setting is enabled, moderators gain the ability to transfer post ownership. However, the implementation did not include proper visibility checks, allowing moderators to transfer ownership of posts from private messages and restricted categories they would not normally be able to access. After transferring ownership to themselves, moderators can then use the data export feature to view the content of these previously inaccessible communications.

The attack requires a moderator-level account and the moderators_change_post_ownership setting to be enabled, limiting the attack surface to a specific configuration and privileged user base. However, the potential for accessing private messages makes this a significant confidentiality concern for affected installations.

Root Cause

The root cause of CVE-2025-68933 is missing authorization checks in the post ownership transfer functionality. The application did not validate whether the requesting moderator had appropriate visibility permissions for both the topic and its posts before processing ownership transfer requests. This oversight allowed moderators to manipulate posts in areas of the forum they were not authorized to access.

Attack Vector

The attack exploits the network-accessible post ownership transfer API endpoint. An attacker with moderator privileges on a Discourse instance with moderators_change_post_ownership enabled can:

1. Identify target private messages or restricted category posts they want to access
2. Use the post ownership transfer feature to assign ownership of those posts to themselves
3. Trigger a user data export to retrieve the content of the transferred posts
4. Gain access to sensitive communications without proper authorization

The attack requires user interaction in the sense that the exported data must be downloaded and reviewed. The vulnerability affects cross-origin resources as the moderator gains access to content belonging to other users' private communications.

Detection Methods for CVE-2025-68933

Indicators of Compromise

• Unusual post ownership transfer activity by non-admin moderators
• Data export requests following ownership transfer operations on private messages
• Audit logs showing moderator access to restricted category content
• Ownership changes on posts in private message topics or restricted categories

Detection Strategies

• Monitor Discourse audit logs for post ownership transfer events involving private messages or restricted categories
• Track data export requests and correlate with recent ownership transfer activities
• Implement alerts for moderators transferring ownership of posts in areas they don't have explicit access to
• Review moderator activity patterns for anomalous behavior related to ownership transfers

Monitoring Recommendations

• Enable comprehensive audit logging for all post ownership transfer operations
• Set up automated alerts for ownership transfers on private message topics
• Regularly review moderator access patterns and data export requests
• Consider implementing additional approval workflows for sensitive ownership transfer operations

How to Mitigate CVE-2025-68933

Immediate Actions Required

• Upgrade Discourse to version 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 or later immediately
• Disable the moderators_change_post_ownership site setting if upgrade is not immediately possible
• Audit recent post ownership transfer activities for potential unauthorized access
• Review moderator permissions and consider limiting post ownership transfer capabilities to administrators only

Patch Information

The patch adds visibility checks for both the topic and posts before allowing ownership transfer operations. This ensures that moderators can only transfer ownership of posts they have legitimate access to view. Updated versions include 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Detailed information is available in the GitHub Security Advisory.

Workarounds

• Disable the moderators_change_post_ownership site setting to prevent non-admin moderators from using the post ownership transfer feature
• Restrict post ownership transfer capabilities to admin users only until patching is complete
• Review and reduce the number of users with moderator privileges to minimize attack surface
• Implement additional monitoring for any post ownership transfer activity while awaiting upgrade

# Configuration workaround: Disable moderator post ownership transfer
# Access Discourse Admin Panel > Settings > Trust
# Or via Rails console:
SiteSetting.moderators_change_post_ownership = false