discourse vulnerabilities (Bitnami)
287 vulnerabilities.
discourseBitnamiDiscourse: Bot debug endpoints disclose whisper translation audit logs4.3 MediumdiscourseBitnamiDiscourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users7.5 HighdiscourseBitnamiDiscourse has a subscription access bypass in its discourse-subscriptions plugin2.1 LowdiscourseBitnamiDiscourse: Information Disclosure in Form Template API Due to Missing Authorization6.0 MediumdiscourseBitnamiDiscourse: Cached outdated summaries can leak removed content5.3 MediumdiscourseBitnamiDiscourse: Staged user custom fields are exposed on public invite pages2.7 LowdiscourseBitnamiDiscourse: Hidden tag visibility bypass on tag routes6.3 MediumdiscourseBitnamiDiscourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure5.1 MediumdiscourseBitnamiDiscourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint5.3 MediumdiscourseBitnamiDiscourse: Group SMTP test endpoint susceptible to SSRF5.3 MediumdiscourseBitnamiDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions6.3 MediumdiscourseBitnamiDiscourse: Authorization bypass in oneboxer via user-controlled category id4.3 MediumdiscourseBitnamiDiscourse: Missing post-level authorization allows whisper metadata disclosure5.3 MediumdiscourseBitnamiDiscourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories6.3 MediumdiscourseBitnamiDiscourse: Unauthorized channel membership inference via excluded_memberships_channel_id4.3 MediumdiscourseBitnamiDiscourse: Category group moderators can perform actions on topics in restricted categories without read access5.3 MediumdiscourseBitnamiDiscourse: Stored XSS via unescaped assignee name2.1 LowdiscourseBitnamiDiscourse: XSS on category description update via API5.4 MediumdiscourseBitnamiDiscourse: Stored XSS in discourse-ai shared conversations onebox5.3 MediumdiscourseBitnamiDiscourse: Admin-only report can be exported by moderators5.3 MediumdiscourseBitnamiDiscourse: Open redirect via `sso_destination_url` cookie in `enter`5.1 MediumdiscourseBitnamidiscourse-subscriptions plugin leaking stripe API key in multisite environment2.0 LowdiscourseBitnamiDiscourse Allows Unauthorized Access to Deleted Posts Index via Group Membership4.9 MediumdiscourseBitnamiDiscourse Authorization Page Displays Unvalidated Redirect Domain2.7 LowdiscourseBitnamiDiscourse users can edit or synonymize hidden tags they can't see3.5 LowdiscourseBitnamiDiscourse has inferable private group membership or existence via exclude_groups parameter6.9 MediumdiscourseBitnamiPM access granted through invites after access revocation5.9 MediumdiscourseBitnamiDiscourse staff can modify any user's group notification level1.3 LowdiscourseBitnamiDiscourse exposes ip_address of flagged user3.5 LowdiscourseBitnamiDiscourse's solved topic stream has potential stored XSS in topic title5.4 MediumdiscourseBitnamiDiscourse user can create Zendesk tickets even when it does not have access to topic5.1 MediumdiscourseBitnamiDiscourse has a Hidden Solved topics permission bypass5.4 MediumdiscourseBitnamiDiscourse's unscoped status lookups leak restricted metadata5.3 MediumdiscourseBitnamiDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check5.3 MediumdiscourseBitnamiDiscourse has a poll authorization bypass via post_id array parameter5.3 MediumdiscourseBitnamiDiscourse hasUnauthorized Exposure of Private User Action Types5.3 MediumdiscourseBitnamiDiscourse has Unauthorized Post Data Exposure in discourse-user-notes5.3 MediumdiscourseBitnamiDiscourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint2.2 LowdiscourseBitnamiDiscourse has Improper Authorization in "Post Edits" Report For Moderators2.2 LowdiscourseBitnamiDiscourse has stored click‑based XSS via Graphviz SVG javascript: links4.4 MediumdiscourseBitnamiDiscourse leaks PM post edits to moderators2.7 LowdiscourseBitnamiDiscourse fixes loose hostname matching in spam host allowlist4.3 MediumdiscourseBitnamiDiscourse filters whisper posts from private-posts feed6.5 MediumdiscourseBitnamiDiscourse hardens chat DM channel creation and expansion5.4 MediumdiscourseBitnamiDiscourse prevents hidden profile data leak via user onebox4.3 MediumdiscourseBitnamiDiscourse missing permission check for policy creation in discourse-policy8.2 HighdiscourseBitnamiDiscourse vulnerable to group membership addition permission bypass via discourse-policy plugin2.3 LowdiscourseBitnamiDiscourse discloses restricted post-action counts to non-privileged users6.9 MediumdiscourseBitnamiDiscourse leaks private topic metadata to non-authorized users6.9 MediumdiscourseBitnamiDiscourse leaks private topic title and post excerpt via user action API endpoint8.7 High- Show moreLoading…