CVE-2025-68660

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68660
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68660.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68660
Aliases
Published
2026-01-28T18:55:11.557Z
Modified
2026-03-01T02:55:47.237188Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse AI Discover's continue conversation allows threat actor to impersonate user
Details

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass the aidiscoverpersona access controls and gain ongoing DM access to personas that may be wired to staff-only categories, RAG document sets, or automated tooling, enabling unauthorized data disclosure. Because the controller also accepts arbitrary user_id, an attacker can impersonate other accounts to trigger unwanted AI conversations on their behalf, generating confusing or abusive PM traffic. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68660.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
78a28cf8d4af429df45c8c48225be125193e5d7a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.5.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
75d61b40ee928a4620b16f5438ca886678fab00d
Fixed
f31b18139a7aadbc4a5f7e8e565a6f4376010c3a
Database specific 
{
    "versions": [
        {
            "introduced": "2025.11.0-latest"
        },
        {
            "fixed": "2025.11.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
3e7317b3344cca6c6510a32cc4c5c0f540132ad9
Fixed
a06dd5861f88643107c9c534a3e75ce4c5fe4bec
Database specific 
{
    "versions": [
        {
            "introduced": "2025.12.0-latest"
        },
        {
            "fixed": "2025.12.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Database specific 
{
    "versions": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.0"
        }
    ]
}

Affected versions

Other
beta
latest-release
release
v2025.*
v2025.11.0
v2025.11.1
v2025.12.0
v2025.12.0-latest
v2026.*
v2026.1.0-latest

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68660.json"