CVE Intelligence
Analysis AI-assisted

CVE-2025-68662: Discourse: SSRF protection bypass via hostname validation in FinalDestination

A hostname validation weakness in the FinalDestination component of Discourse can allow bypassing SSRF protections under certain conditions, according to the record. NVD scores it critical at 9.9 (CVSS 3.1), and the record lists patched versions 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 with no known workarounds. Administrators should upgrade to a patched release; no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-68662 affects Discourse, an open source discussion platform. According to the record, a hostname validation issue in the FinalDestination component could allow bypassing server-side request forgery (SSRF) protections under certain conditions. The record classifies the weakness as CWE-918, Server-Side Request Forgery.

Impact

  • NVD rates the vulnerability critical with a CVSS 3.1 base score of 9.9.
  • The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates a network attack vector, low attack complexity, low privileges required, no user interaction, changed scope and high impact on confidentiality, integrity and availability.
  • The record also carries a 7.6 score from the GitHub CNA, which differs from the NVD score.
  • SSRF can cause the server to send requests to destinations it is not meant to reach. The internal resources that would be exposed depend on each deployment, which the record does not describe.

Affected products and versions

  • Product: Discourse (Discourse Discourse).
  • The affected list in the record includes versions below 3.5.4, versions from 2025.11.0 up to but not including 2025.11.2, version 2025.12.0 and version 2026.1.0.
  • The description states that the issue is fixed in 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0. The record's fixes field is empty, so the fixed versions come from the description only.
  • The affected list and the description conflict on 2026.1.0. Check the vendor advisory before concluding which builds are vulnerable.

Exploitation status

The record marks this CVE as not listed in the CISA KEV catalog, and EPSS data is absent. No confirmed exploitation appears in the sources consulted. Teams should still treat the critical score and the network-reachable vector as reasons to prioritize patching.

Remediation and mitigation

  • Upgrade Discourse to one of the patched releases that matches your installation branch: 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0.
  • The description states that no known workarounds are available, so patching is the reliable path.
  • Review the GitHub security advisory for the authoritative list of affected and fixed builds.
  • After upgrading, confirm the running version in the administration interface.

Detection guidance

  • Review web and application logs for requests that cause the server to contact internal addresses, loopback interfaces or cloud metadata endpoints.
  • Monitor outbound connections from the Discourse host for destinations that are not expected business services.
  • Track changes to link preview, onebox or remote fetch behavior, since these features commonly rely on the FinalDestination logic.

Limitations of the available information

  • The record does not describe the exact conditions required to bypass the protection, and this analysis does not provide them.
  • The record does not state whether the GitHub and NVD scores reflect different assumptions.
  • The conflict between the affected list and the fixed-version description for 2026.1.0 is unresolved in the record.
  • No EPSS score or SSVC data is available.
  • The public references consulted are limited to the GitHub advisory and NVD and CVE.org pages.

Frequently asked questions

Is this Discourse vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The critical score still justifies prompt patching.

Which Discourse version should I upgrade to?

The description lists 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 as fixed versions. Choose the patched release on your installation branch and check the GitHub advisory, because the record's affected list conflicts on 2026.1.0.

Are there workarounds if I cannot patch right away?

The record states that no known workarounds are available, so upgrading is the recommended remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.