CVE-2025-69289: Discourse

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the "require_change_email_confirmation" setting.

Affected products

• Discourse Discourse: before 3.5.4 (fixed in 3.5.4); from 2025.11.0, before 2025.11.2 (fixed in 2025.11.2); version 2025.12.0 only; version 2026.1.0 only

Published 2026-01-28. Last modified 2026-06-17.