Skip to contentDiscourse vulnerabilities
Newest
- discourseDiscourse: Replying to a whisper lets non-whisperers create staff-only whisper postsCVE-2026-44783Fix available5.4 Medium
- discourseDiscourse: GroupPostSerializer leaks hidden full names through reaction post associationCVE-2026-44782Fix available4.3 Medium
- discourseDiscourse: Category queue reviewers can read raw incoming emails from queued postsCVE-2026-44780Fix available4.3 Medium
- discourseDiscourse: Bot debug endpoints disclose whisper translation audit logsCVE-2026-44779Fix available4.3 Medium
- discourseDiscourse: Public chat MessageBus broadcasts are not restricted to chat-eligible usersCVE-2026-44786Fix available7.5 High
- discourseDiscourse has a subscription access bypass in its discourse-subscriptions pluginCVE-2026-34154Fix available2.1 Low
- discourseDiscourse: Information Disclosure in Form Template API Due to Missing AuthorizationCVE-2026-33514Fix available6.0 Medium
- discourseDiscourse: Cached outdated summaries can leak removed contentCVE-2026-32244Fix available5.3 Medium
- discourseDiscourse: Staged user custom fields are exposed on public invite pagesCVE-2026-34947Fix available2.7 Low
- discourseDiscourse: Hidden tag visibility bypass on tag routesCVE-2026-27481Fix available6.3 Medium
- discourseDiscourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content ExposureCVE-2026-33415Fix available5.1 Medium
- discourseDiscourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpointCVE-2026-33300Fix available5.3 Medium
- discourseDiscourse: Group SMTP test endpoint susceptible to SSRFCVE-2026-33185Fix available5.3 Medium
- discourseDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptionsCVE-2026-33074Fix available6.3 Medium
- discourseDiscourse: Authorization bypass in oneboxer via user-controlled category idCVE-2026-32951Fix available4.3 Medium
- discourseDiscourse: Missing post-level authorization allows whisper metadata disclosureCVE-2026-32620Fix available5.3 Medium
- discourseDiscourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categoriesCVE-2026-32619Fix available6.3 Medium
- discourseDiscourse: Unauthorized channel membership inference via excluded_memberships_channel_idCVE-2026-32618Fix available4.3 Medium
- discourseDiscourse: Category group moderators can perform actions on topics in restricted categories without read accessCVE-2026-32615Fix available5.3 Medium
- discourseDiscourse: Stored XSS via unescaped assignee nameCVE-2026-32607Fix available2.1 Low
- discourseDiscourse: XSS on category description update via APICVE-2026-32273Fix available5.4 Medium
- discourseDiscourse: Stored XSS in discourse-ai shared conversations oneboxCVE-2026-32243Fix available5.3 Medium
- discourseDiscourse: Admin-only report can be exported by moderatorsCVE-2026-32143Fix available5.3 Medium
- discourseDiscourse: Open redirect via `sso_destination_url` cookie in `enter`CVE-2026-32113Fix available5.1 Medium
- discoursediscourse-subscriptions plugin leaking stripe API key in multisite environmentCVE-2026-33073Fix available2.0 Low
- discourseDiscourse Allows Unauthorized Access to Deleted Posts Index via Group MembershipCVE-2026-33428Fix available4.9 Medium
- discourseDiscourse Authorization Page Displays Unvalidated Redirect DomainCVE-2026-33427Fix available2.7 Low
- discourseDiscourse users can edit or synonymize hidden tags they can't seeCVE-2026-33426Fix available3.5 Low
- discourseDiscourse has inferable private group membership or existence via exclude_groups parameterCVE-2026-33425Fix available6.9 Medium
- discoursePM access granted through invites after access revocationCVE-2026-33424Fix available5.9 Medium
- discourseDiscourse staff can modify any user's group notification levelCVE-2026-33423Fix available1.3 Low
- discourseDiscourse exposes ip_address of flagged userCVE-2026-33422Fix available3.5 Low
- discourseDiscourse's solved topic stream has potential stored XSS in topic titleCVE-2026-33411Fix available5.4 Medium
- discourseDiscourse user can create Zendesk tickets even when it does not have access to topicCVE-2026-33291Fix available5.1 Medium
- discourseDiscourse has a Hidden Solved topics permission bypassCVE-2026-33251Fix available5.4 Medium
- discourseDiscourse's unscoped status lookups leak restricted metadataCVE-2026-32114Fix available5.3 Medium
- discourseDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` checkCVE-2026-31869Fix available5.3 Medium
- discourseDiscourse has a poll authorization bypass via post_id array parameterCVE-2026-31805Fix available5.3 Medium
- discourseDiscourse hasUnauthorized Exposure of Private User Action TypesCVE-2026-30891Fix available5.3 Medium
- discourseDiscourse has Unauthorized Post Data Exposure in discourse-user-notesCVE-2026-30889Fix available5.3 Medium
- discourseDiscourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpointCVE-2026-30888Fix available2.2 Low
- discourseDiscourse has Improper Authorization in "Post Edits" Report For ModeratorsCVE-2026-33408Fix available2.2 Low
- discourseDiscourse has stored click‑based XSS via Graphviz SVG javascript: linksCVE-2026-33395Fix available4.4 Medium
- discourseDiscourse leaks PM post edits to moderatorsCVE-2026-33394Fix available2.7 Low
- discourseDiscourse fixes loose hostname matching in spam host allowlistCVE-2026-33393Fix available4.3 Medium
- discourseDiscourse filters whisper posts from private-posts feedCVE-2026-33355Fix available6.5 Medium
- discourseDiscourse hardens chat DM channel creation and expansionCVE-2026-33410Fix available5.4 Medium
- discourseDiscourse prevents hidden profile data leak via user oneboxCVE-2026-32099Fix available4.3 Medium
- discourseDiscourse missing permission check for policy creation in discourse-policyCVE-2026-29072Fix available8.2 High
- discourseDiscourse vulnerable to group membership addition permission bypass via discourse-policy pluginCVE-2026-28282Fix available2.3 Low
- Show moreLoading…