# Users randomly added to private messages (including messages from System)

**URL:** https://meta.discourse.org/t/users-randomly-added-to-private-messages-including-messages-from-system/245511
**Category:** Bug
**Created:** [November 14, 2022, 12:39pm UTC](https://meta.discourse.org/t/users-randomly-added-to-private-messages-including-messages-from-system/245511 "2022-11-14T12:39:43Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [November 14, 2022, 12:42pm UTC](https://meta.discourse.org/t/users-randomly-added-to-private-messages-including-messages-from-system/245511/2 "2022-11-14T12:42:09Z")

</div>

That’s this issue [Invitation can cause users to be erroneously and transparently added to private message · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-gh5r-j595-qx48)

It has been addressed in version 2.9.0 beta 12 which has been released earlier today, so upgrading would resolve this. The update also contains code that removes the users from the PM’s again.

---

_[View the full topic](https://meta.discourse.org/t/users-randomly-added-to-private-messages-including-messages-from-system/245511)._