CVE-2025-32376: Discourse DM limits aren’t always properly enforced

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-30 · updated 2026-06-17
Weakness: CWE-284

Description

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

Affected products

discourse: before 3.4.3; 1.1.0-beta1, 1.1.0-beta2, 1.1.0-beta3, 1.1.0-beta4, 1.1.0-beta5, 1.1.0-beta6 (+225) — fixed in 3.4.3

How to fix

Upgrade to a fixed version: discourse 3.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-32376 or the next vulnerability affects your stack