CVE-2025-24808: 
NixOS vulnerability analysis and mitigation

Discourse, an open-source discussion platform, was found to contain a race condition vulnerability (CVE-2025-24808) that affects versions prior to 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch. The vulnerability was discovered and disclosed on March 26, 2025, allowing users who are about to reach the limit of users in a group DM to bypass this limit by sending parallel requests to add new users (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue stems from a race condition in the group DM user addition process, where parallel requests could bypass the implemented user limit checks. The vulnerability requires network access and low privilege levels to exploit, with no user interaction needed (GitHub Advisory).

The vulnerability allows attackers to bypass the group DM user limit restrictions by exploiting the race condition. This could lead to unauthorized addition of users to group DMs beyond the intended limit, potentially impacting the platform's access control mechanisms (GitHub Advisory).

The vulnerability has been patched in versions 3.3.4 and 3.4.0.beta5. The fix implements a lock step in the service to wrap part of the add_users_to_channel service inside a distributed lock/mutex, preventing the race condition. Users are advised to upgrade to these patched versions (GitHub Commit).