CVE-2025-69218

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-01-30

Assigner: GitHub, Inc.

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments that moderators should not have access to. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. There is no workaround. Limit moderator privileges to trusted users until the patch is applied.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-01-30

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-69218

EUVD

EUVD-2025-206444

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	to 3.5.4 (exc)
discourse	discourse	From 2025.11.0 (inc) to 2025.11.2 (exc)
discourse	discourse	2025.12.0
discourse	discourse	2026.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Mitigation Strategies

Limit moderator privileges to trusted users until the patch is applied. Upgrade Discourse to version 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 where this issue is patched.

Executive Summary

This vulnerability in Discourse allows moderators, who should have limited access, to view the 'top_uploads' admin report that is intended only for admins. This report contains direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments. As a result, moderators can access sensitive information they are not authorized to see.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive data because moderators can access private files and data exports that should be restricted to admins only. This exposure could result in privacy breaches, data leaks, and potential misuse of sensitive user and administrative information.

Hi! I’m here to help you understand CVE-2025-69218. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70