| Package | Affected versions | Patched versions |
|---|---|---|
| discourse | = 2025.11.0= 2025.12.0< 3.5.3 | 3.5.3 |
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free