CVE-2025-64528: Discourse

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.

Affected products

• Discourse Discourse: before 3.5.3 (fixed in 3.5.3); version 2025.11.0 only; version 2025.12.0 only

Published 2025-12-30. Last modified 2026-06-17.