A Server-Side Request Forgery vulnerability in Discourse allows authenticated attackers to potentially interact with internal network resources by bypassing existing security protections.

The vulnerability exists due to improper hostname validation within the FinalDestination module, which can be exploited by an authenticated user to perform unauthorized requests against internal systems. This SSRF flaw specifically impacts the application's ability to restrict outbound requests to unintended targets.

Successful exploitation of this vulnerability could lead to unauthorized access to internal services that are not exposed to the public internet. Given the CVSS score of 7.6, this represents a high-risk scenario where an attacker might exfiltrate sensitive internal data or probe internal network architecture. Compromise of these internal assets could result in significant security breaches and loss of confidentiality.

Immediate Action: Upgrade to Discourse version 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 immediately to apply the necessary security patches.

Proactive Monitoring: Review web server and application access logs for anomalous outgoing requests or unusual hostname patterns originating from the FinalDestination module.

Compensating Controls: Ensure that the server hosting Discourse is segmented from sensitive internal network zones and that egress filtering is configured to prevent unauthorized communication with internal endpoints.

Public Exploit Available: No (exploit_available: false)

Organizations running the affected versions of Discourse should prioritize this update within their standard maintenance cycle. Because this vulnerability allows an authenticated attacker to bypass SSRF protections, it poses a direct risk to internal infrastructure security. Apply the provided vendor patches immediately to remediate the flaw and prevent potential exploitation.