CVE-2025-64528

MEDIUM

Discourse <3.5.3, <2025.11.1, <2025.12.0 - Info Disclosure

Title source: llm
STIX 2.1

Description

Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0005
EPSS Percentile 16.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-202
Status published
Products (3)
discourse/discourse 2025.11.0
discourse/discourse 2025.12.0
discourse/discourse < 3.5.3
Published Dec 30, 2025
Tracked Since Feb 18, 2026