CVE-2025-68660
📋 TL;DR
This vulnerability in Discourse allows authenticated users to bypass AI persona access controls, gaining unauthorized access to staff-only AI personas and potentially sensitive data. Attackers can also impersonate other users to trigger unwanted AI conversations. All Discourse instances running vulnerable versions are affected.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to staff-only AI personas connected to sensitive data sources (RAG document sets, automated tooling) leading to data exfiltration, plus impersonation attacks generating abusive private messages.
Likely Case
Authenticated users gaining unauthorized access to AI personas they shouldn't have, potentially accessing restricted information and impersonating other users in AI conversations.
If Mitigated
Limited impact with proper access controls and monitoring, but still potential for confusion from impersonated AI conversations.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-mrvm-rprq-jqqh
Restart Required: Yes
Instructions:
1. Backup your Discourse instance. 2. Update to one of the patched versions (3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0). 3. Restart the Discourse service. 4. Verify the update was successful.
🧯 If You Can't Patch
- Disable AI features entirely if not needed
- Implement strict access controls and monitoring for AI persona endpoints
🔍 How to Verify
Check if Vulnerable:
Check Discourse version via admin panel or run: `cd /var/discourse && ./launcher status app`Check Version:
cd /var/discourse && ./launcher status app | grep versionVerify Fix Applied:
Verify version is 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 or later📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to AI persona endpoints
- Multiple DM conversations initiated by same user to staff personas
- User accessing AI personas outside their permission scope
Network Indicators:
- Increased traffic to AI endpoints from non-staff users
- Unusual pattern of DM creation
SIEM Query:
source="discourse" AND (endpoint="ai_discover_persona" OR action="create_dm") | stats count by user_id