CVE-2025-64528
Users are able to find users by name even when `enable_names` is off
Résumé
Users are able to find users by name even when enable_names is off
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when enable_names is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.3"},{"introduced":"2025.11.0"},{"fixed":"2025.11.1"}]}]
Références
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- web nvd.nist.gov