# New user added to all private message threads

**URL:** https://meta.discourse.org/t/new-user-added-to-all-private-message-threads/253203
**Category:** Support
**Created:** [January 28, 2023, 9:34pm UTC](https://meta.discourse.org/t/new-user-added-to-all-private-message-threads/253203 "2023-01-28T21:34:32Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [January 28, 2023, 9:48pm UTC](https://meta.discourse.org/t/new-user-added-to-all-private-message-threads/253203/2 "2023-01-28T21:48:40Z")

</div>

Which version of discourse do you use?

> [@Users randomly added to private messages (including messages from System)](https://meta.discourse.org/t/users-randomly-added-to-private-messages-including-messages-from-system/245511/2):
>
> That’s this issue [Invitation can cause users to be erroneously and transparently added to private message · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-gh5r-j595-qx48) It has been addressed in version 2.9.0 beta 12 which has been released earlier today, so upgrading would resolve this. The update also contains code that removes the users from the PM’s again.

---

_[View the full topic](https://meta.discourse.org/t/new-user-added-to-all-private-message-threads/253203)._