Discourse Group Direct Message Preference Bypass Vulnerability

A vulnerability exists in Discourse versions prior to 3.3.4 on the stable branch and prior to 3.4.0.beta5 on the beta branch. In certain situations, users could be added to group direct messages even after disabling direct messaging in their preferences. This issue has been patched in versions 3.3.4 and 3.4.0.beta5. As a workaround, users can disable chat in their preferences to avoid being added to new group chats.

Impact

This vulnerability allows for the bypass of user preferences regarding direct messaging, potentially leading to unwanted group chat additions.