# Users unexpectedly added to direct messages
**URL:** https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696
**Category:** Support
**Created:** [November 15, 2022, 8:19pm UTC](https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696 "2022-11-15T20:19:47Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [November 15, 2022, 8:19pm UTC](https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696/1 "2022-11-15T20:19:47Z")
I’m not sure if it should be in #Contribute > Bug rather than here but on 2.9.0.beta11 ( [dea44ec923](https://github.com/discourse/discourse/commits/dea44ec923b1f4fced6dafbbf8109820cf1ca7a4) )
3 (seemingly random) users seem to have been added to **every** direct messages (even between system and admin) 🤯
Has anyone any idea how I could pinpoint why ? And I’m open to any suggestion on the best way to remove them from the PM 😅
even if it removes them from theirs..
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [November 15, 2022, 8:56pm UTC](https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696/2 "2022-11-15T20:56:23Z")
I believe that has been reported and fixed. If you update to Latest it should sort everything out. 👍
> [@Users randomly added to private messages (including messages from System)](https://meta.discourse.org/t/users-randomly-added-to-private-messages-including-messages-from-system/245511/2):
>
> That’s this issue [Invitation can cause users to be erroneously and transparently added to private message · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-gh5r-j595-qx48) It has been addressed in version 2.9.0 beta 12 which has been released earlier today, so upgrading would resolve this. The update also contains code that removes the users from the PM’s again.
---
### Author:  [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [November 15, 2022, 8:59pm UTC](https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696/3 "2022-11-15T20:59:11Z")
Oh I’m sorry, I swear I’ve looked for it before posting !
might I’ve been a bit stressed by the surprise 🤪
---
### Author:  [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [November 15, 2022, 9:18pm UTC](https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696/4 "2022-11-15T21:18:26Z")
and worst thing is I’ve actually read the announcement :
> [@2.9.0.beta12: Security fix, bug fixes and more](https://meta.discourse.org/t/2-9-0-beta12-security-fix-bug-fixes-and-more/245469/1):
>
> Prevent email from being nil in InviteRedeemer
but thought… _meh_ and didn’t click on the CVE 🙄
I was already in the process of _rails c_ my way through it…
but I can confirm that an upgrade resolves this… 🍾
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 8, 2024, 12:36pm UTC](https://meta.discourse.org/t/users-unexpectedly-added-to-direct-messages/245696/5 "2024-06-08T12:36:44Z")
This topic was automatically closed after 570 days. New replies are no longer allowed.