https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T02:19:57.267095+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-69289 CVE-2025-69289 — Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via ema… 2026-10-18T02:19:57.268345+00:00

Affected: discourse

Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the "require_change_email_confirmation" setting.