I have just noticed that a new user who signed up a few weeks ago has been added to every single private message thread on the system, such as all my personal ones, and even the welcome messages from the discobot! How could this have happened? Has my security been somehow infiltrated? I have locked her on level 0 for now, so that she can’t access the private message feed, until I have figured out what on Earth is going on.

Which version of discourse do you use? [image] Users randomly added to private messages (including messages from System) Bug That’s this issue Invitation can cause users to be erroneously and transparently added to private message · Advisory · discourse/discourse · GitHub It has been addressed in version 2.9.0 beta 12 which has been released earlier today, so upgrading would resolve this. The update also contains code that removes the users from the PM’s again.

Thank you very much for linking to this bug - this is exactly what is happening as I am out of date on 2.9.0.beta11 - will update right now!

New user added to all private message threads

Product Support

Moin January 28, 2023, 9:48pm 2

Which version of discourse do you use?

Topic		Replies	Views
Users randomly added to private messages (including messages from System) Bug	2	631	November 14, 2022
Users unexpectedly added to direct messages Product Support	3	654	November 15, 2022
Prevent adding additional users to personal messages? Feature personal-messages	20	1576	February 11, 2026
Users unable to add others to a personal message Product Support	41	5568	December 20, 2021
PM's put who is in the conversation at the top? UX	3	753	February 11, 2019

New user added to all private message threads

Related topics