Discourse Direct Message User Limit Bypass Vulnerability

A vulnerability in Discourse prior to stable version 3.4.3 and beta version 3.5.0.beta3 allows users to bypass the direct message (DM) user limit. This could potentially enable the creation of a DM that includes every user from a site. The issue arises because the platform did not properly enforce user limits when adding participants to a DM channel, failing to account for users already included in the conversation.

Impact

Exploitation of this vulnerability could lead to the unauthorized inclusion of all users from a site in a direct message, effectively bypassing the intended user limit for DMs.

Reproduction

To reproduce this vulnerability, create a direct message channel and attempt to add users while exceeding the maximum allowed limit. The channel can be filled to capacity, but the vulnerability allows for additional users to be added by bypassing the limit enforcement.

Remediation

Users can update to Discourse stable version 3.4.3 or beta version 3.5.0.beta3, where this vulnerability has been patched.