CVE-2025-64528
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Dec 30, 2025
CISA due date
—
The record
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | discourse | 0 | 3.5.3 |
Related vulnerabilities
- CVE-2025-67723 Discourse is an open source discussion platform. Also affects discourse
- CVE-2025-61598 Discourse is missing Cache-Control response header on error responses Also affects discourse
- CVE-2024-53991 Discourse is an open source platform for community discussion. Also affects discourse
- CVE-2026-16520 Improper input validation and Exposure of sensitive information through data queries… CWE-202
- CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph… CWE-202
- CVE-2026-70473 Flowise is a drag-and-drop user interface for building customized large language model… CWE-202
- CVE-2026-42797 Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. CWE-202
- CVE-2026-40245 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-202