CVE-2025-64528
📋 TL;DR
This vulnerability in Discourse allows attackers to discover users' full names even when the 'enable_names' setting is disabled, by using partial username knowledge through UI or API. It affects Discourse instances running versions before 3.5.3, 2025.11.1, and 2025.12.0. This exposes user privacy and could facilitate targeted attacks.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deanonymize users, enabling targeted social engineering, harassment, or doxxing campaigns against specific individuals.
Likely Case
Privacy violation where attackers can link partial usernames to real identities, potentially compromising user anonymity.
If Mitigated
Limited impact if usernames are already public or if user base is small and known, but privacy expectations are still violated.
🎯 Exploit Status
Exploitation requires only partial username knowledge and can be done via UI or API without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.3, 2025.11.1, or 2025.12.0
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-c59w-jwx7-34v4
Restart Required: Yes
Instructions:
1. Backup your Discourse instance. 2. Update to Discourse version 3.5.3, 2025.11.1, or 2025.12.0 using your deployment method (Docker, manual, etc.). 3. Restart the Discourse service. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Enable Names Setting
linuxTemporarily enable the 'enable_names' setting to make full names publicly visible, eliminating the information disclosure aspect.
cd /var/discourse
./launcher enter app
rails c
SiteSetting.enable_names = true
🧯 If You Can't Patch
- Implement rate limiting on user search endpoints to make enumeration more difficult
- Monitor logs for unusual patterns of user search queries from single IPs
🔍 How to Verify
Check if Vulnerable:
Check Discourse version via admin panel or run: cd /var/discourse && ./launcher enter app && cat /usr/src/app/VERSIONCheck Version:
cd /var/discourse && ./launcher enter app && cat /usr/src/app/VERSIONVerify Fix Applied:
After patching, test that partial username searches no longer return full names when 'enable_names' is disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of user search requests
- Patterns of sequential username guessing attempts
Network Indicators:
- High frequency of requests to /u/search endpoints
- API calls with partial username parameters
SIEM Query:
source="discourse.logs" AND (uri_path="/u/search" OR message="user search") | stats count by src_ip🔗 References
- https://github.com/discourse/discourse/commit/1cb45b8b287597085e3514596ffb1d9b41938f81
- https://github.com/discourse/discourse/commit/6192f55629624925595dae14364fd86cac0f09df
- https://github.com/discourse/discourse/commit/e936a523b5900a9d866d23ea3da904ba12bb0fb2
- https://github.com/discourse/discourse/security/advisories/GHSA-c59w-jwx7-34v4
