Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2017-20290Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
- CVE-2026-57447Discourse Doc Categories: Doc category index refresh leaks private topic titles
- CVE-2026-55103Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
- CVE-2026-91157Discourse: Media uploads remain publicly accessible after category permissions are restricted
- CVE-2026-91156Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- CVE-2026-91159Discourse: Stored oEmbed HTML injection via allowed iframe
- CVE-2026-91119Discourse: Encode action_code_who in mention URLs
- CVE-2026-91121Discourse: Chat upload filenames rendered as raw HTML in excerpts
- CVE-2026-91120Discourse: Stored HTML injection in video notification emails
- CVE-2026-91132Discourse: Wildcard iframe origin allowlist bypass via authority separators
- CVE-2026-91122Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- CVE-2026-91123Discourse: Reject literal backslash path separators in iframe src traversal guard
- CVE-2026-91133Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
- CVE-2026-91134Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
- CVE-2026-84302Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
- CVE-2026-59830Discourse: Stored XSS via unescaped actor name in post actions
- CVE-2026-53960Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
- CVE-2026-55704Discourse: Shared-draft titles and excerpts leak through group post serialization
- CVE-2026-55674Discourse: Cache poisoning/XSS via color scheme cookies
- CVE-2026-59829Discourse: Review queue exposes flag-related private message excerpts to category group moderators
- CVE-2026-72732Discourse: Templates endpoint exposes hidden tag names
- CVE-2026-72731Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
- CVE-2026-72730Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
- CVE-2026-72729Discourse: Stored XSS in discourse-local-dates plugin
- CVE-2026-72728Discourse: Onebox iframe origin allowlist enforces URL authority boundary
- CVE-2026-72727Discourse: Stored XSS in the moderation review queue
- CVE-2026-72726Discourse: Unauthorized eavesdropping on private AI bot conversations.
- CVE-2026-72725Discourse: Stored XSS in staff action logs injects staff UI
- CVE-2026-72724Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
- CVE-2026-72723Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags