CVE-2025-64528
Users are able to find users by name even when `enable_names` is off
概要
Users are able to find users by name even when enable_names is off
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when enable_names is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.3"},{"introduced":"2025.11.0"},{"fixed":"2025.11.1"}]}]
参照URL
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- web nvd.nist.gov