CVE-2025-64528
Users are able to find users by name even when `enable_names` is off
Summary
Users are able to find users by name even when enable_names is off
Original description
The description as published by the source.
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when enable_names is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.3"},{"introduced":"2025.11.0"},{"fixed":"2025.11.1"}]}]
References
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- web nvd.nist.gov