Discourse AI Suggestion Endpoints Info Disclosure (3.5.0)
CVE-2025-58055 Published on October 1, 2025
Discourse AI Suggestions Contain Insecure Direct Object Reference
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic Title, Category, and Tags allowed authenticated users to extract information about topics that they werent authorized to access. By modifying the topic_id value in API requests to the AI suggestion endpoints, users could target specific restricted topics. The AI models responses then disclosed information that the authenticated user couldnt normally access. This issue is fixed in version 3.5.1. To workaround this issue, users can restrict group access to the AI helper feature through the "composer_ai_helper_allowed_groups" and "post_ai_helper_allowed_groups" site settings.
Vulnerability Analysis
CVE-2025-58055 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Types
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2025-58055 has been classified to as an Authorization vulnerability or weakness.
What is an Insecure Direct Object Reference / IDOR Vulnerability?
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVE-2025-58055 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.
Products Associated with CVE-2025-58055
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse Version < 3.5.1 is affected by CVE-2025-58055Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.