CVE-2025-68660: 
NixOS vulnerability analysis and mitigation

CVE-2025-68660 is an incorrect authorization vulnerability in Discourse, an open-source discussion platform, that allows any authenticated user to bypass ai_discover_persona access controls and gain unauthorized direct message (DM) access to AI personas restricted to staff-only categories, RAG document sets, or automated tooling. It affects Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The vulnerability was published on January 28, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization): a Discourse endpoint responsible for the AI Discover "continue conversation" feature fails to properly enforce ai_discover_persona access controls before granting DM access to AI personas. Additionally, the vulnerable controller accepts an arbitrary user_id parameter without validation, meaning an attacker can supply any user's ID to initiate AI conversations on behalf of other accounts. Exploitation requires only a valid authenticated session — no elevated privileges, special configuration, or user interaction is needed. No public proof-of-concept code has been identified (GitHub Advisory).

Successful exploitation allows an authenticated attacker to access AI personas configured for staff-only use, potentially exposing sensitive data from restricted categories, RAG document sets, or integrated tooling that those personas are wired to. The user_id impersonation vector enables the attacker to generate unwanted or abusive private message (PM) traffic attributed to other users' accounts, undermining platform integrity and user trust. Availability is not impacted, but both confidentiality (unauthorized data disclosure) and integrity (unauthorized actions on behalf of other users) are affected (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-68660. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The attack requires only a low-privilege authenticated account and no user interaction, making it relatively straightforward to exploit if an attacker has forum access (GitHub Advisory, Red Hat CVE).

1. Obtain authenticated access: Register or log in to a vulnerable Discourse instance (any standard user account is sufficient; no staff or admin privileges required).
2. Identify the vulnerable endpoint: Locate the AI Discover "continue conversation" endpoint within the Discourse AI plugin, which handles persona DM initiation.
3. Craft a malicious request: Send an HTTP request to the vulnerable endpoint, supplying a user_id parameter set to the ID of another user (e.g., a staff member or any target account) and a persona_id corresponding to a restricted AI persona.
4. Bypass access controls: Because the endpoint does not validate ai_discover_persona permissions for the requesting user, the server initiates a DM conversation between the target user and the restricted AI persona.
5. Access restricted data: Interact with the AI persona via the established DM channel to extract information from staff-only categories, RAG document sets, or connected tooling that the persona has access to (GitHub Advisory).

• Network: Unusual or repeated HTTP requests to the Discourse AI Discover "continue conversation" endpoint from non-staff user accounts, particularly with varying user_id values not matching the authenticated session.
• Logs: Discourse application logs showing DM/PM creation events initiated by low-privilege users targeting AI personas restricted to staff; entries where the user_id in the request differs from the authenticated user's ID.
• Application Behavior: Unexpected private message threads appearing in staff or other users' inboxes involving AI personas, especially if those users did not initiate the conversation; AI persona conversations referencing staff-only category content accessed by non-staff accounts.

Discourse has released patched versions that address this vulnerability: 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. Administrators should upgrade to one of these versions immediately. The vendor has confirmed that no configuration-based workarounds are available — upgrading is the only remediation (GitHub Advisory).