Discourse vulnerabilities

Products

• Discourse 295
• Discourse-calendar 7
• Calendar 4
• Discourse-reactions 4
• Calendar 3
• Discourse-chat 3
• Discourse-ai 2
• Reactions 2

Newest

• discourse Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed CVE-2017-20290 5.1 MediumOctober 22, 2026
• discourse discourse-doc-categories Discourse Doc Categories: Doc category index refresh leaks private topic titles CVE-2026-57447 4.3 MediumOctober 16, 2026
• discourse discourse-activity-pub Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening CVE-2026-55103 8.6 HighOctober 15, 2026
• discourse Discourse: Media uploads remain publicly accessible after category permissions are restricted CVE-2026-91157 Fix available 7.5 HighOctober 14, 2026
• discourse Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users CVE-2026-91156 Fix available 7.5 HighOctober 14, 2026
• discourse Discourse: Stored oEmbed HTML injection via allowed iframe CVE-2026-91159 Public exploitFix available 7.7 HighOctober 14, 2026
• discourse Discourse: Encode action_code_who in mention URLs CVE-2026-91119 Fix available 6.4 MediumSeptember 24, 2026
• discourse Discourse: Chat upload filenames rendered as raw HTML in excerpts CVE-2026-91121 Fix available 5.0 MediumSeptember 24, 2026
• discourse Discourse: Stored HTML injection in video notification emails CVE-2026-91120 Fix available 5.4 MediumSeptember 24, 2026
• discourse Discourse: Wildcard iframe origin allowlist bypass via authority separators CVE-2026-91132 Fix available 4.3 MediumSeptember 24, 2026
• discourse Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users CVE-2026-91122 Fix available 8.7 HighSeptember 24, 2026
• discourse Discourse: Reject literal backslash path separators in iframe src traversal guard CVE-2026-91123 Fix available 7.2 HighSeptember 24, 2026
• discourse Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure CVE-2026-91133 Fix available 6.5 MediumSeptember 24, 2026
• discourse Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist CVE-2026-91134 Fix available 5.4 MediumSeptember 24, 2026
• discourse Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables CVE-2026-84302 Fix available 4.2 MediumSeptember 24, 2026
• discourse Discourse: Stored XSS via unescaped actor name in post actions CVE-2026-59830 Fix available 5.4 MediumSeptember 21, 2026
• discourse Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD CVE-2026-53960 Fix available 5.3 MediumAugust 17, 2026
• discourse Discourse: Shared-draft titles and excerpts leak through group post serialization CVE-2026-55704 Fix available 4.3 MediumAugust 17, 2026
• discourse Discourse: Cache poisoning/XSS via color scheme cookies CVE-2026-55674 Fix available 9.3 CriticalAugust 17, 2026
• discourse Discourse: Review queue exposes flag-related private message excerpts to category group moderators CVE-2026-59829 Fix available 4.3 MediumAugust 17, 2026
• discourse Discourse: Templates endpoint exposes hidden tag names CVE-2026-72732 Fix available 4.3 MediumAugust 10, 2026
• discourse Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer CVE-2026-72731 Fix available 7.1 HighAugust 10, 2026
• discourse Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor CVE-2026-72730 Fix available 8.7 HighAugust 10, 2026
• discourse Discourse: Stored XSS in discourse-local-dates plugin CVE-2026-72729 Fix available 2.0 LowAugust 10, 2026
• discourse Discourse: Onebox iframe origin allowlist enforces URL authority boundary CVE-2026-72728 Fix available 6.3 MediumAugust 10, 2026
• discourse Discourse: Stored XSS in the moderation review queue CVE-2026-72727 Fix available 4.8 MediumAugust 10, 2026
• discourse Discourse: Unauthorized eavesdropping on private AI bot conversations. CVE-2026-72726 Fix available 6.5 MediumAugust 10, 2026
• discourse Discourse: Stored XSS in staff action logs injects staff UI CVE-2026-72725 Fix available 5.4 MediumAugust 10, 2026
• discourse Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch CVE-2026-72724 Fix available 4.3 MediumAugust 10, 2026
• discourse Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags CVE-2026-72723 Fix available 5.3 MediumAugust 10, 2026
• discourse Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs CVE-2026-72722 Fix available 4.3 MediumAugust 10, 2026
• discourse Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison CVE-2026-72721 Fix available 5.3 MediumAugust 10, 2026
• discourse Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing CVE-2026-72720 Fix available 6.4 MediumAugust 10, 2026
• discourse Discourse: Private event sample invitees are serialized to non-invited event viewers CVE-2026-45780 Fix available 5.3 MediumJuly 9, 2026
• discourse Discourse: Stored-XSS in 2FA delete confirmation modal CVE-2026-53963 Fix available 7.3 HighJuly 9, 2026
• discourse Discourse: Hidden post revisions leak through adjacent visible diffs CVE-2026-59828 Fix available 5.3 MediumJuly 9, 2026
• discourse Discourse: Signup-time primary_group_id assignment grants whisperer access CVE-2026-44787 Fix available 8.2 HighJuly 9, 2026
• discourse Discourse: Insufficient SVG sanitization logic CVE-2026-53962 Fix available 5.4 MediumJuly 9, 2026
• discourse Discourse: Topic featured link susceptible to stored XSS CVE-2026-55424 Fix available 7.4 HighJuly 9, 2026
• discourse Discourse: Secure uploads exposed by hotlinked image copying CVE-2026-45788 Fix available 6.3 MediumJuly 9, 2026
• discourse Discourse: Hidden tag names leaked via category serializers CVE-2026-49256 Fix available 6.3 MediumJuly 9, 2026
• discourse Discourse: Regular users can route multipart uploads into the admin backup store CVE-2026-46413 Fix available 6.5 MediumJuly 9, 2026
• discourse Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding) CVE-2026-53961 Fix available 6.5 MediumJuly 9, 2026
• discourse Discourse: Remote code execution via pdf uploads CVE-2026-55420 Fix available 7.5 HighJuly 9, 2026
• discourse Discourse: Don't leak restricted tag group names via tag info CVE-2026-47264 Fix available 5.3 MediumJune 12, 2026
• discourse Discourse: Prevent webhook payload disclosure on event redelivery CVE-2026-47263 Fix available 4.3 MediumJune 12, 2026
• discourse Discourse: Cross-site backup access via path traversal in multisite local backups CVE-2026-45775 Fix available 6.8 MediumJune 12, 2026
• discourse Discourse: Chat misauthorization and information disclosure CVE-2026-45085 Fix available 5.3 MediumJune 12, 2026
• discourse Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts CVE-2026-44785 Fix available 4.3 MediumJune 12, 2026
• discourse Discourse: Non-staff group owners can see email password in plaintext through group history CVE-2026-44784 Fix available 6.5 MediumJune 12, 2026
• Show olderLoading…