Discourse 3.2.3 Stable Release
Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on lack of change than lack of bugs - all releases, including those on tests-passed and beta are production ready.
Security Updates
This release includes fixes for these security issues reported by our community and HackerOne.
- DoS through Onebox (CVE-2024-35227)
- Stored-dom XSS via Facebook Oneboxes (CVE-2024-35234)
- Missing authorization checks for suspending admins/moderators (CVE-2024-36113)
- Limit reviewable user serializer payload (CVE-2024-36122)
- SSRF via FastImage (CVE-2024-37157)