What is the CVSS score of CVE-2025-58055?

CVE-2025-58055 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Discourse are affected by CVE-2025-58055?

Organizations using Discourse should be aware of moderate risk from CVE-2025-58055, a improper access control vulnerability rated CVSS 4.3.. A patch is available.

How to fix or mitigate CVE-2025-58055?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Discourse CVE-2025-58055

EUVD-2025-33228 MEDIUM

Improper Access Control (CWE-284)

2025-10-01 security-advisories@github.com

Authentication Bypass Discourse

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 18:18 euvd

EUVD-2025-33228

Analysis Generated

Mar 13, 2026 - 18:18 vuln.today

Patch released

Oct 23, 2025 - 14:15 nvd

Patch available

CVE Published

Oct 01, 2025 - 19:15 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topic_id” value in API requests to the AI suggestion endpoints, users could target specific restricted topics. The AI model’s responses then disclosed information that the authenticated user couldn’t normally access. This issue is fixed in version 3.5.1. To workaround this issue, users can restrict group access to the AI helper feature through the "composer_ai_helper_allowed_groups" and "post_ai_helper_allowed_groups" site settings.