CVE-2025-64528: 
NixOS vulnerability analysis and mitigation

CVE-2025-64528 is an information disclosure vulnerability in Discourse, the open-source discussion platform, that allows unauthenticated attackers to enumerate users and their full names via the UI or API even when the enable_names site setting is disabled. The vulnerability affects all Discourse versions prior to 3.5.3, versions 2025.11.0 through 2025.11.0 (fixed in 2025.11.1), and versions in the 2025.12.0-latest branch prior to the stable 2025.12.0 release. It was published on December 30, 2025, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-202 (Exposure of Sensitive Information Through Data Queries). The Search#user_search method in lib/search.rb was not respecting the enable_names site setting when constructing its PostgreSQL full-text search query (ts_query). User full names are indexed at weight 'B' in the search index via SearchIndexer.update_users_index, and the unpatched code passed no weight filter to ts_query, meaning name-weight tokens were always included in search results regardless of the enable_names setting. The fix adds a weight_filter parameter — when enable_names is disabled, the query is restricted to weights 'A' and 'C' (excluding 'B', the name weight), so searches against partial name strings no longer return user records (GitHub Commit, GitHub Advisory).

Exploitation allows any unauthenticated network attacker to enumerate Discourse users and extract their full real names by submitting partial username or name queries through the search UI or API, bypassing the privacy control intended by the enable_names setting. This exposes personally identifiable information (PII) that administrators explicitly chose to hide, enabling targeted social engineering, harassment campaigns, or the construction of comprehensive user databases. There is no integrity or availability impact; the vulnerability is limited to confidentiality of user identity data (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and only basic network access, making it trivially accessible to any external attacker who can reach the Discourse instance. The EPSS score is approximately 0.041% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a publicly accessible Discourse instance running a version prior to 3.5.3 or 2025.11.1. Confirm the instance has enable_names disabled (this can be inferred if user full names are not displayed in the UI but the setting is not enforced in search).
2. Craft search query: Submit a partial name or username string via the Discourse search UI (e.g., https://forum.example.com/search?q=john) or directly via the search API endpoint (e.g., GET /search.json?q=john&include_blurbs=false).
3. Extract user data: Parse the JSON API response or UI results, which will return matching user objects including usernames and full names, even though enable_names is disabled.
4. Iterate for enumeration: Repeat with different partial strings (e.g., single letters or common name fragments) to systematically enumerate all users and their associated full names from the Discourse instance (GitHub Advisory, GitHub Commit).

• Network: High volume of search API requests (GET /search.json?q=<partial_string>) from a single IP or small IP range, especially with single-character or short query strings cycling through the alphabet.
• Logs: Discourse application logs showing repeated unauthenticated search queries with varied short query terms in rapid succession; access logs with many requests to /search or /search.json endpoints from the same source.
• Behavioral: Search queries returning user results for name fragments (e.g., first names, last names) on instances where enable_names is disabled — this indicates the unpatched behavior is being actively queried.

Upgrade Discourse to one of the patched versions: 3.5.3 (stable branch), 2025.11.1 (November 2025 stable), or 2025.12.0 (December 2025 stable). For instances that cannot be patched immediately, consider implementing network-level access controls to restrict unauthenticated access to the search API endpoint, and monitor access logs for bulk username enumeration patterns. No configuration-only workaround fully mitigates the vulnerability without patching, as the flaw is in the search query logic itself (GitHub Advisory, GitHub Commit).