CVE-2025-68933

CVSS v3 6.9 MEDIUM

6.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

D

iscourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites that grant moderators post ownership transfer permissions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The patch adds visibility checks for both the topic and posts before allowing ownership transfer. As a workaround, disable the `moderators_change_post_ownership` site setting to prevent non-admin moderators from using the post ownership transfer feature.

References

Link	Resource
https://github.com/discourse/discourse/security/advisories/GHSA-hpxv-mw7v-fqg2	Third Party Advisory Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:2025.12.0::::stable:::
	cpe:2.3:a:discourse:discourse:2026.1.0::::stable:::

History

30 Jan 2026, 20:47

Type	Values Removed	Values Added
First Time		Discourse discourse Discourse
References	~~() https://github.com/discourse/discourse/security/advisories/GHSA-hpxv-mw7v-fqg2 -~~	() https://github.com/discourse/discourse/security/advisories/GHSA-hpxv-mw7v-fqg2 - Third Party Advisory, Mitigation
CPE		cpe:2.3:a:discourse:discourse:::::stable:::* cpe:2.3:a:discourse:discourse:2026.1.0::::stable::: cpe:2.3:a:discourse:discourse:2025.12.0::::stable:::

28 Jan 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-28 20:16

Updated : 2026-01-30 20:47

NVD link : CVE-2025-68933

Mitre link : CVE-2025-68933

CVE.ORG link : CVE-2025-68933

JSON object : View

Products Affected

discourse

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-68933", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2026-01-28T20:16:12.477", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-hpxv-mw7v-fqg2", "tags": ["Third Party Advisory", "Mitigation"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites that grant moderators post ownership transfer permissions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The patch adds visibility checks for both the topic and posts before allowing ownership transfer. As a workaround, disable the `moderators_change_post_ownership` site setting to prevent non-admin moderators from using the post ownership transfer feature."}], "lastModified": "2026-01-30T20:47:13.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "FDBF21E2-1191-4020-A17A-0702DE4E6451", "versionEndExcluding": "3.5.4"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "539B5B85-44F0-408E-B994-08BB20EA9C26", "versionEndExcluding": "2025.11.2", "versionStartIncluding": "2025.11.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:2025.12.0:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "CCBF47A8-0D3F-4174-8084-CD3517BF272A"}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.1.0:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "F6CF5F98-F08F-4B28-BBE2-8296760A547E"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}