What is CVE-2025-68662?

CVE-2025-68662 is a high-severity vulnerability in Discourse, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.6/10. Published 2026-01-28.

How severe is CVE-2025-68662?

High severity. CVSS v3 base score is 7.6 out of 10.

SSRF in Discourse

CVE-2025-68662

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.003 (22.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.

Affected products

Discourse — versions >= 2026.1.0-latest, < 2026.1.0, >= 2025.12.0-latest, < 2025.12.1, < 3.5.4

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2025-68662?: CVE-2025-68662 is a high-severity vulnerability in Discourse, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.6/10. Published 2026-01-28.
How severe is CVE-2025-68662?: High severity. CVSS v3 base score is 7.6 out of 10.