# cve.now: Discourse

The newest entries naming Discourse as an affected vendor (up to 200), of 323 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2017-20290](https://cve.now/CVE-2017-20290.md): Discourse \< 1.9.0.beta13 Reflected XSS via /email/unsubscribed (CVSS 5.1)
- [CVE-2026-57447](https://cve.now/CVE-2026-57447.md): Discourse Doc Categories: Doc category index refresh leaks private topic titles (CVSS 4.3)
- [CVE-2026-55103](https://cve.now/CVE-2026-55103.md): Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening (CVSS 8.6)
- [CVE-2026-91157](https://cve.now/CVE-2026-91157.md): Discourse: Media uploads remain publicly accessible after category permissions are restricted (CVSS 7.5)
- [CVE-2026-91156](https://cve.now/CVE-2026-91156.md): Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users (CVSS 7.5)
- [CVE-2026-91159](https://cve.now/CVE-2026-91159.md): Discourse: Stored oEmbed HTML injection via allowed iframe (CVSS 7.7)
- [CVE-2026-91119](https://cve.now/CVE-2026-91119.md): Discourse: Encode action\_code\_who in mention URLs (CVSS 6.4)
- [CVE-2026-91121](https://cve.now/CVE-2026-91121.md): Discourse: Chat upload filenames rendered as raw HTML in excerpts (CVSS 5.0)
- [CVE-2026-91120](https://cve.now/CVE-2026-91120.md): Discourse: Stored HTML injection in video notification emails (CVSS 5.4)
- [CVE-2026-91132](https://cve.now/CVE-2026-91132.md): Discourse: Wildcard iframe origin allowlist bypass via authority separators (CVSS 4.3)
- [CVE-2026-91122](https://cve.now/CVE-2026-91122.md): Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users (CVSS 8.7)
- [CVE-2026-91123](https://cve.now/CVE-2026-91123.md): Discourse: Reject literal backslash path separators in iframe src traversal guard (CVSS 7.2)
- [CVE-2026-91133](https://cve.now/CVE-2026-91133.md): Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure (CVSS 6.5)
- [CVE-2026-91134](https://cve.now/CVE-2026-91134.md): Discourse: Block post iframes whose encoded userinfo bypasses the allowed\_iframes allowlist (CVSS 5.4)
- [CVE-2026-84302](https://cve.now/CVE-2026-84302.md): Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables (CVSS 4.2)
- [CVE-2026-59830](https://cve.now/CVE-2026-59830.md): Discourse: Stored XSS via unescaped actor name in post actions (CVSS 5.4)
- [CVE-2026-53960](https://cve.now/CVE-2026-53960.md): Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD (CVSS 5.3)
- [CVE-2026-55704](https://cve.now/CVE-2026-55704.md): Discourse: Shared-draft titles and excerpts leak through group post serialization (CVSS 4.3)
- [CVE-2026-55674](https://cve.now/CVE-2026-55674.md): Discourse: Cache poisoning/XSS via color scheme cookies (CVSS 9.3)
- [CVE-2026-59829](https://cve.now/CVE-2026-59829.md): Discourse: Review queue exposes flag-related private message excerpts to category group moderators (CVSS 4.3)
- [CVE-2026-72732](https://cve.now/CVE-2026-72732.md): Discourse: Templates endpoint exposes hidden tag names (CVSS 4.3)
- [CVE-2026-72731](https://cve.now/CVE-2026-72731.md): Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer (CVSS 7.1)
- [CVE-2026-72730](https://cve.now/CVE-2026-72730.md): Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor (CVSS 8.7)
- [CVE-2026-72729](https://cve.now/CVE-2026-72729.md): Discourse: Stored XSS in discourse-local-dates plugin (CVSS 2.0)
- [CVE-2026-72728](https://cve.now/CVE-2026-72728.md): Discourse: Onebox iframe origin allowlist enforces URL authority boundary (CVSS 6.3)
- [CVE-2026-72727](https://cve.now/CVE-2026-72727.md): Discourse: Stored XSS in the moderation review queue (CVSS 4.8)
- [CVE-2026-72726](https://cve.now/CVE-2026-72726.md): Discourse: Unauthorized eavesdropping on private AI bot conversations. (CVSS 6.5)
- [CVE-2026-72725](https://cve.now/CVE-2026-72725.md): Discourse: Stored XSS in staff action logs injects staff UI (CVSS 5.4)
- [CVE-2026-72724](https://cve.now/CVE-2026-72724.md): Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch (CVSS 4.3)
- [CVE-2026-72723](https://cve.now/CVE-2026-72723.md): Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags (CVSS 5.3)
- [CVE-2026-72722](https://cve.now/CVE-2026-72722.md): Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs (CVSS 4.3)
- [CVE-2026-72721](https://cve.now/CVE-2026-72721.md): Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison (CVSS 5.3)
- [CVE-2026-72720](https://cve.now/CVE-2026-72720.md): Discourse: HTML injection in PrettyText.format\_for\_email from cooked-attribute reparsing (CVSS 6.4)
- [CVE-2026-45780](https://cve.now/CVE-2026-45780.md): Discourse: Private event sample invitees are serialized to non-invited event viewers (CVSS 5.3)
- [CVE-2026-53963](https://cve.now/CVE-2026-53963.md): Discourse: Stored-XSS in 2FA delete confirmation modal (CVSS 7.3)
- [CVE-2026-59828](https://cve.now/CVE-2026-59828.md): Discourse: Hidden post revisions leak through adjacent visible diffs (CVSS 5.3)
- [CVE-2026-44787](https://cve.now/CVE-2026-44787.md): Discourse: Signup-time primary\_group\_id assignment grants whisperer access (CVSS 8.2)
- [CVE-2026-53962](https://cve.now/CVE-2026-53962.md): Discourse: Insufficient SVG sanitization logic (CVSS 5.4)
- [CVE-2026-55424](https://cve.now/CVE-2026-55424.md): Discourse: Topic featured link susceptible to stored XSS (CVSS 7.4)
- [CVE-2026-45788](https://cve.now/CVE-2026-45788.md): Discourse: Secure uploads exposed by hotlinked image copying (CVSS 6.3)
- [CVE-2026-49256](https://cve.now/CVE-2026-49256.md): Discourse: Hidden tag names leaked via category serializers (CVSS 6.3)
- [CVE-2026-46413](https://cve.now/CVE-2026-46413.md): Discourse: Regular users can route multipart uploads into the admin backup store (CVSS 6.5)
- [CVE-2026-53961](https://cve.now/CVE-2026-53961.md): Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding) (CVSS 6.5)
- [CVE-2026-55420](https://cve.now/CVE-2026-55420.md): Discourse: Remote code execution via pdf uploads (CVSS 7.5)
- [CVE-2026-47264](https://cve.now/CVE-2026-47264.md): Discourse: Don't leak restricted tag group names via tag info (CVSS 5.3)
- [CVE-2026-47263](https://cve.now/CVE-2026-47263.md): Discourse: Prevent webhook payload disclosure on event redelivery (CVSS 4.3)
- [CVE-2026-45775](https://cve.now/CVE-2026-45775.md): Discourse: Cross-site backup access via path traversal in multisite local backups (CVSS 6.8)
- [CVE-2026-45085](https://cve.now/CVE-2026-45085.md): Discourse: Chat misauthorization and information disclosure (CVSS 5.3)
- [CVE-2026-44785](https://cve.now/CVE-2026-44785.md): Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts (CVSS 4.3)
- [CVE-2026-44784](https://cve.now/CVE-2026-44784.md): Discourse: Non-staff group owners can see email password in plaintext through group history (CVSS 6.5)
- [CVE-2026-44783](https://cve.now/CVE-2026-44783.md): Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts (CVSS 5.4)
- [CVE-2026-44782](https://cve.now/CVE-2026-44782.md): Discourse: GroupPostSerializer leaks hidden full names through reaction post association (CVSS 4.3)
- [CVE-2026-44780](https://cve.now/CVE-2026-44780.md): Discourse: Category queue reviewers can read raw incoming emails from queued posts (CVSS 4.3)
- [CVE-2026-44779](https://cve.now/CVE-2026-44779.md): Discourse: Bot debug endpoints disclose whisper translation audit logs (CVSS 4.3)
- [CVE-2026-44786](https://cve.now/CVE-2026-44786.md): Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users (CVSS 7.5)
- [CVE-2026-34154](https://cve.now/CVE-2026-34154.md): Discourse has a subscription access bypass in its discourse-subscriptions plugin (CVSS 2.1)
- [CVE-2026-33514](https://cve.now/CVE-2026-33514.md): Discourse: Information Disclosure in Form Template API Due to Missing Authorization (CVSS 6.0)
- [CVE-2026-32244](https://cve.now/CVE-2026-32244.md): Discourse: Cached outdated summaries can leak removed content (CVSS 5.3)
- [CVE-2026-34947](https://cve.now/CVE-2026-34947.md): Discourse: Staged user custom fields are exposed on public invite pages (CVSS 2.7)
- [CVE-2026-27481](https://cve.now/CVE-2026-27481.md): Discourse: Hidden tag visibility bypass on tag routes (CVSS 6.3)
- [CVE-2026-33415](https://cve.now/CVE-2026-33415.md): Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure (CVSS 5.1)
- [CVE-2026-33300](https://cve.now/CVE-2026-33300.md): Discourse: Hidden group names and access metadata are exposed to moderators through the \`category-chatables\` endpoint (CVSS 5.3)
- [CVE-2026-33185](https://cve.now/CVE-2026-33185.md): Discourse: Group SMTP test endpoint susceptible to SSRF (CVSS 5.3)
- [CVE-2026-33074](https://cve.now/CVE-2026-33074.md): Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions (CVSS 6.3)
- [CVE-2026-32951](https://cve.now/CVE-2026-32951.md): Discourse: Authorization bypass in oneboxer via user-controlled category id (CVSS 4.3)
- [CVE-2026-32620](https://cve.now/CVE-2026-32620.md): Discourse: Missing post-level authorization allows whisper metadata disclosure (CVSS 5.3)
- [CVE-2026-32619](https://cve.now/CVE-2026-32619.md): Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories (CVSS 6.3)
- [CVE-2026-32618](https://cve.now/CVE-2026-32618.md): Discourse: Unauthorized channel membership inference via excluded\_memberships\_channel\_id (CVSS 4.3)
- [CVE-2026-32615](https://cve.now/CVE-2026-32615.md): Discourse: Category group moderators can perform actions on topics in restricted categories without read access (CVSS 5.3)
- [CVE-2026-32607](https://cve.now/CVE-2026-32607.md): Discourse: Stored XSS via unescaped assignee name (CVSS 2.1)
- [CVE-2026-32273](https://cve.now/CVE-2026-32273.md): Discourse: XSS on category description update via API (CVSS 5.4)
- [CVE-2026-32243](https://cve.now/CVE-2026-32243.md): Discourse: Stored XSS in discourse-ai shared conversations onebox (CVSS 5.3)
- [CVE-2026-32113](https://cve.now/CVE-2026-32113.md): Discourse: Open redirect via \`sso\_destination\_url\` cookie in \`enter\` (CVSS 5.1)
- [CVE-2026-32143](https://cve.now/CVE-2026-32143.md): Discourse: Admin-only report can be exported by moderators (CVSS 5.3)
- [CVE-2026-33073](https://cve.now/CVE-2026-33073.md): discourse-subscriptions plugin leaking stripe API key in multisite environment (CVSS 2.0)
- [CVE-2026-33428](https://cve.now/CVE-2026-33428.md): Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership (CVSS 4.9)
- [CVE-2026-33427](https://cve.now/CVE-2026-33427.md): Discourse Authorization Page Displays Unvalidated Redirect Domain (CVSS 2.7)
- [CVE-2026-33426](https://cve.now/CVE-2026-33426.md): Discourse users can edit or synonymize hidden tags they can't see (CVSS 3.5)
- [CVE-2026-33425](https://cve.now/CVE-2026-33425.md): Discourse has inferable private group membership or existence via exclude\_groups parameter (CVSS 6.9)
- [CVE-2026-33424](https://cve.now/CVE-2026-33424.md): PM access granted through invites after access revocation (CVSS 5.9)
- [CVE-2026-33423](https://cve.now/CVE-2026-33423.md): Discourse staff can modify any user's group notification level (CVSS 1.3)
- [CVE-2026-33422](https://cve.now/CVE-2026-33422.md): Discourse exposes ip\_address of flagged user (CVSS 3.5)
- [CVE-2026-33411](https://cve.now/CVE-2026-33411.md): Discourse's solved topic stream has potential stored XSS in topic title (CVSS 5.4)
- [CVE-2026-33291](https://cve.now/CVE-2026-33291.md): Discourse user can create Zendesk tickets even when it does not have access to topic (CVSS 5.1)
- [CVE-2026-33251](https://cve.now/CVE-2026-33251.md): Discourse has a Hidden Solved topics permission bypass (CVSS 5.4)
- [CVE-2026-32114](https://cve.now/CVE-2026-32114.md): Discourse's unscoped status lookups leak restricted metadata (CVSS 5.3)
- [CVE-2026-31869](https://cve.now/CVE-2026-31869.md): Discourse: Composer mentions endpoint leaks hidden group membership through PM \`allowed\_names\` check (CVSS 5.3)
- [CVE-2026-31805](https://cve.now/CVE-2026-31805.md): Discourse has a poll authorization bypass via post\_id array parameter (CVSS 5.3)
- [CVE-2026-30891](https://cve.now/CVE-2026-30891.md): Discourse hasUnauthorized Exposure of Private User Action Types (CVSS 5.3)
- [CVE-2026-30889](https://cve.now/CVE-2026-30889.md): Discourse has Unauthorized Post Data Exposure in discourse-user-notes (CVSS 5.3)
- [CVE-2026-30888](https://cve.now/CVE-2026-30888.md): Discourse has moderator privilege escalation via arbitrary post\_id in suspend/silence endpoint (CVSS 2.2)
- [CVE-2026-33408](https://cve.now/CVE-2026-33408.md): Discourse has Improper Authorization in "Post Edits" Report For Moderators (CVSS 2.2)
- [CVE-2026-33395](https://cve.now/CVE-2026-33395.md): Discourse has stored click‑based XSS via Graphviz SVG javascript: links (CVSS 4.4)
- [CVE-2026-33394](https://cve.now/CVE-2026-33394.md): Discourse leaks PM post edits to moderators (CVSS 2.7)
- [CVE-2026-33393](https://cve.now/CVE-2026-33393.md): Discourse fixes loose hostname matching in spam host allowlist (CVSS 4.3)
- [CVE-2026-33355](https://cve.now/CVE-2026-33355.md): Discourse filters whisper posts from private-posts feed (CVSS 6.5)
- [CVE-2026-33410](https://cve.now/CVE-2026-33410.md): Discourse hardens chat DM channel creation and expansion (CVSS 5.4)
- [CVE-2026-32099](https://cve.now/CVE-2026-32099.md): Discourse prevents hidden profile data leak via user onebox (CVSS 4.3)
- [CVE-2026-29072](https://cve.now/CVE-2026-29072.md): Discourse missing permission check for policy creation in discourse-policy (CVSS 8.2)
- [CVE-2026-28282](https://cve.now/CVE-2026-28282.md): Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin (CVSS 2.3)
- [CVE-2026-27936](https://cve.now/CVE-2026-27936.md): Discourse discloses restricted post-action counts to non-privileged users (CVSS 6.9)
- [CVE-2026-27935](https://cve.now/CVE-2026-27935.md): Discourse leaks private topic metadata to non-authorized users (CVSS 6.9)
- [CVE-2026-27934](https://cve.now/CVE-2026-27934.md): Discourse leaks private topic title and post excerpt via user action API endpoint (CVSS 8.7)
- [CVE-2026-27740](https://cve.now/CVE-2026-27740.md): Discourse has Stored XSS in AI Triage Automation (CVSS 5.1)
- [CVE-2026-27570](https://cve.now/CVE-2026-27570.md): Discourse Vulnerable to Stored XSS via Shared AI Conversation Onebox (CVSS 5.1)
- [CVE-2026-27491](https://cve.now/CVE-2026-27491.md): Discourse has a bypass of official warnings messages by non-staff users (CVSS 6.9)
- [CVE-2026-27454](https://cve.now/CVE-2026-27454.md): Discourse has check revision visibility on posts endpoint (CVSS 5.3)
- [CVE-2026-27166](https://cve.now/CVE-2026-27166.md): Discourse vulnerable to HTML injection via prohibited iframe URLs (CVSS 4.1)
- [CVE-2026-28227](https://cve.now/CVE-2026-28227.md): Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish\_to\_category (CVSS 1.2)
- [CVE-2026-28219](https://cve.now/CVE-2026-28219.md): Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners (CVSS 1.3)
- [CVE-2026-28218](https://cve.now/CVE-2026-28218.md): Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution (CVSS 5.3)
- [CVE-2026-27154](https://cve.now/CVE-2026-27154.md): Discourse has XSS when editing a malicious post (CVSS 1.3)
- [CVE-2026-27153](https://cve.now/CVE-2026-27153.md): Discourse doesn't prevent moderators from exporting user Chat DMs (CVSS 1.3)
- [CVE-2026-27152](https://cve.now/CVE-2026-27152.md): DIscourse has DM communication-preference bypass when adding members (CVSS 1.3)
- [CVE-2026-27162](https://cve.now/CVE-2026-27162.md): DIscourse doesn't prevent whispers to leak in excerpts (CVSS 4.9)
- [CVE-2026-27151](https://cve.now/CVE-2026-27151.md): Discourse doesn't validate destination topic when moving posts (CVSS 1.3)
- [CVE-2026-27150](https://cve.now/CVE-2026-27150.md): Discourse doesn't ensure guardian check when creating QueryGroupBookmark (CVSS 1.3)
- [CVE-2026-27149](https://cve.now/CVE-2026-27149.md): Discourse has SQL injection in PM tag filtering (CVSS 4.9)
- [CVE-2026-27021](https://cve.now/CVE-2026-27021.md): Discourse: Poll voters endpoint lacked post visibility checks (CVSS 6.9)
- [CVE-2026-26979](https://cve.now/CVE-2026-26979.md): Discourse: TL4 users are able to change status of restricted topics (CVSS 0.0)
- [CVE-2026-26973](https://cve.now/CVE-2026-26973.md): Discourse doesn't scope reviewable notes to user-visible reviewables (CVSS 4.3)
- [CVE-2026-26265](https://cve.now/CVE-2026-26265.md): Discourse has IDOR vulnerability in the directory items endpoint (CVSS 7.5)
- [CVE-2026-26207](https://cve.now/CVE-2026-26207.md): DIscourse's discourse-policy plugin lacks post access check (CVSS 5.4)
- [CVE-2026-26078](https://cve.now/CVE-2026-26078.md): Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint (CVSS 7.5)
- [CVE-2026-26077](https://cve.now/CVE-2026-26077.md): Discourse doesn't ensure webhooks require a token (CVSS 6.5)
- [CVE-2026-24742](https://cve.now/CVE-2026-24742.md): Discourse staff action logs expose sensitive information to moderators (CVSS 6.5)
- [CVE-2026-23743](https://cve.now/CVE-2026-23743.md): Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users (CVSS 6.9)
- [CVE-2026-21865](https://cve.now/CVE-2026-21865.md): Discourse topic conversion permission vulnerability for moderators (CVSS 6.5)
- [CVE-2025-69289](https://cve.now/CVE-2025-69289.md): Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change (CVSS 5.1)
- [CVE-2025-69218](https://cve.now/CVE-2025-69218.md): Discourse moderators can access admin-only reports exposing private upload URLs (CVSS 7.1)
- [CVE-2025-68934](https://cve.now/CVE-2025-68934.md): Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint (CVSS 6.5)
- [CVE-2025-68933](https://cve.now/CVE-2025-68933.md): Discourse non-admin moderators can exfiltrate private content via post ownership transfer (CVSS 6.9)
- [CVE-2025-68666](https://cve.now/CVE-2025-68666.md): Discourse users archives leaked to users with moderation privileges (CVSS 5.9)
- [CVE-2025-68662](https://cve.now/CVE-2025-68662.md): FinalDestination hostname matching allows SSRF protection bypass (CVSS 7.6)
- [CVE-2025-68660](https://cve.now/CVE-2025-68660.md): Discourse AI Discover's continue conversation allows threat actor to impersonate user (CVSS 5.3)
- [CVE-2025-68659](https://cve.now/CVE-2025-68659.md): Discourse has DoS vulnerability in username change endpoint (CVSS 4.3)
- [CVE-2025-68479](https://cve.now/CVE-2025-68479.md): Discourse subscriptions are susceptible to takeover (CVSS 7.1)
- [CVE-2025-67723](https://cve.now/CVE-2025-67723.md): Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin (CVSS 4.6)
- [CVE-2025-66488](https://cve.now/CVE-2025-66488.md): Discourse allows script execution in uploaded HTML/XML files on S3 (CVSS 4.6)
- [CVE-2025-64528](https://cve.now/CVE-2025-64528.md): Users are able to find users by name even when \`enable\_names\` is off (CVSS 6.3)
- [CVE-2025-61598](https://cve.now/CVE-2025-61598.md): Discourse is missing Cache-Control response header on error responses (CVSS 6.3)
- [CVE-2025-59337](https://cve.now/CVE-2025-59337.md): Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments (CVSS 5.5)
- [CVE-2025-58055](https://cve.now/CVE-2025-58055.md): Discourse AI Suggestions Contain Insecure Direct Object Reference (CVSS 4.3)
- [CVE-2025-58054](https://cve.now/CVE-2025-58054.md): Discourse is vulnerable to XSS when quoting chat messages (CVSS 3.5)
- [CVE-2025-54411](https://cve.now/CVE-2025-54411.md): Discourse welcome banner user name XSS (CVSS 2.4)
- [CVE-2025-53102](https://cve.now/CVE-2025-53102.md): Discourse's WebAuthn challenge isn't cleared from user session after authentication (CVSS 8.2)
- [CVE-2025-49845](https://cve.now/CVE-2025-49845.md): Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers (CVSS 6.3)
- [CVE-2025-48954](https://cve.now/CVE-2025-48954.md): Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow (CVSS 8.1)
- [CVE-2025-48877](https://cve.now/CVE-2025-48877.md): Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe (CVSS 8.1)
- [CVE-2025-48062](https://cve.now/CVE-2025-48062.md): Discourse vulnerable to HTML injection when inviting to topic via email (CVSS 7.1)
- [CVE-2025-48053](https://cve.now/CVE-2025-48053.md): Discourse vulnerable to DoS via large URL payload in PM to a bot (CVSS 8.7)
- [CVE-2025-47288](https://cve.now/CVE-2025-47288.md): Discourse Policy plugin private group members visible (CVSS 3.5)
- [CVE-2025-46824](https://cve.now/CVE-2025-46824.md): Discourse Code Review Plugin vulnerable to XSS via auto link commits (CVSS 3.1)
- [CVE-2025-46813](https://cve.now/CVE-2025-46813.md): Private data leak on login-required Discourse sites (CVSS 5.8)
- [CVE-2025-32376](https://cve.now/CVE-2025-32376.md): Discourse DM limits aren’t always properly enforced (CVSS 4.8)
- [CVE-2025-24972](https://cve.now/CVE-2025-24972.md): Discourse may bypass user preference when adding users to chat groups (CVSS 4.3)
- [CVE-2025-24808](https://cve.now/CVE-2025-24808.md): Discourse has race condition when adding users to a group DM (CVSS 4.3)
- [CVE-2024-53266](https://cve.now/CVE-2024-53266.md): Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse (CVSS 4.3)
- [CVE-2024-53851](https://cve.now/CVE-2024-53851.md): Partial denial of service via inline oneboxes in Discourse (CVSS 4.3)
- [CVE-2024-53994](https://cve.now/CVE-2024-53994.md): Potential bypass of chat permissions in Discourse (CVSS 4.3)
- [CVE-2024-55948](https://cve.now/CVE-2024-55948.md): Anonymous cache poisoning via XHR requests in Discourse (CVSS 8.2)
- [CVE-2024-56197](https://cve.now/CVE-2024-56197.md): Users can see other user's tagged PMs in Discourse (CVSS 2.2)
- [CVE-2024-56328](https://cve.now/CVE-2024-56328.md): HTMLi(XSS without CSP) via Onebox urls in Discourse (CVSS 6.5)
- [CVE-2025-22601](https://cve.now/CVE-2025-22601.md): Client Side Path Traversal using activate account route in Discourse (CVSS 3.1)
- [CVE-2025-22602](https://cve.now/CVE-2025-22602.md): Stored DOM-based XSS (without CSP) via video placeholders in Discourse (CVSS 6.5)
- [CVE-2025-23023](https://cve.now/CVE-2025-23023.md): Anonymous cache poisoning via request headers in Discourse (CVSS 8.2)
- [CVE-2024-54142](https://cve.now/CVE-2024-54142.md): Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse (CVSS 9.1)
- [CVE-2024-49765](https://cve.now/CVE-2024-49765.md): Bypass of Discourse Connect using other login paths if enabled in Discourse (CVSS 5.3)
- [CVE-2024-52589](https://cve.now/CVE-2024-52589.md): Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse (CVSS 2.2)
- [CVE-2024-52794](https://cve.now/CVE-2024-52794.md): Magnific lightbox susceptible to Cross-site Scripting in Discourse (CVSS 6.8)
- [CVE-2024-53991](https://cve.now/CVE-2024-53991.md): Potential Backup file leaked via Nginx in Discourse (CVSS 7.5)
- [CVE-2024-47773](https://cve.now/CVE-2024-47773.md): Anonymous cache poisoning via XHR requests in Discourse (CVSS 8.2)
- [CVE-2024-47772](https://cve.now/CVE-2024-47772.md): Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse (CVSS 6.5)
- [CVE-2024-43789](https://cve.now/CVE-2024-43789.md): Denial of service by the absence of restrictions on replies to posts in Discourse (CVSS 7.5)
- [CVE-2024-45297](https://cve.now/CVE-2024-45297.md): Prevent topic list filtering by hidden tags for unauthorized users in Discourse (CVSS 5.3)
- [CVE-2024-45051](https://cve.now/CVE-2024-45051.md): Bypass of email address validation via encoded email addresses in Discourse (CVSS 8.2)
- [CVE-2024-45303](https://cve.now/CVE-2024-45303.md): Discourse Calendar plugin event names susceptible to XSS (CVSS 6.1)
- [CVE-2024-21658](https://cve.now/CVE-2024-21658.md): Insufficient control of region value length in discourse-calendar (CVSS 4.3)
- [CVE-2024-43408](https://cve.now/CVE-2024-43408.md): Discourse Placeholder Forms has a XSS stopped by CSP (CVSS 6.3)
- [CVE-2024-39320](https://cve.now/CVE-2024-39320.md): Discourse allows iframe injection though default site setting (CVSS 6.1)
- [CVE-2024-37299](https://cve.now/CVE-2024-37299.md): Discourse vulnerable to DoS via Tag Group (CVSS 4.9)
- [CVE-2024-37165](https://cve.now/CVE-2024-37165.md): Discourse has an XSS via Onebox system (CVSS 6.3)
- [CVE-2024-38360](https://cve.now/CVE-2024-38360.md): Denial of service via Watched Words in Discourse (CVSS 4.9)
- [CVE-2024-37157](https://cve.now/CVE-2024-37157.md): Discourse vulnerable to Server-Side Request Forgery via FastImage (CVSS 6.4)
- [CVE-2024-36122](https://cve.now/CVE-2024-36122.md): Discourse doesn't limit reviewable user serializer payload (CVSS 2.4)
- [CVE-2024-36113](https://cve.now/CVE-2024-36113.md): Discourse missing authorization checks for suspending admins/moderators (CVSS 4.9)
- [CVE-2024-35234](https://cve.now/CVE-2024-35234.md): Discourse vulnerable to stored-dom XSS via Facebook Oneboxes (CVSS 4.2)
- [CVE-2024-35227](https://cve.now/CVE-2024-35227.md): Discourse vulnerable to DoS through Onebox (CVSS 7.5)
- [CVE-2024-35168](https://cve.now/CVE-2024-35168.md): WordPress WP Discourse plugin \<= 2.5.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-31219](https://cve.now/CVE-2024-31219.md): Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page (CVSS 4.3)
- [CVE-2024-27085](https://cve.now/CVE-2024-27085.md): Denial of service through invites in Discourse (CVSS 6.5)
- [CVE-2024-27100](https://cve.now/CVE-2024-27100.md): Denial of service via Staff Actions in Discourse (CVSS 6.5)
- [CVE-2024-28242](https://cve.now/CVE-2024-28242.md): Disclosure of the existence of secret categories with custom backgrounds in Discourse (CVSS 5.3)
- [CVE-2024-24748](https://cve.now/CVE-2024-24748.md): Disclosure of the existence of secret subcategories in Discourse (CVSS 5.3)
- [CVE-2024-24827](https://cve.now/CVE-2024-24827.md): No rate limits on POST /uploads endpoint in Discourse (CVSS 5.3)
- [CVE-2024-24817](https://cve.now/CVE-2024-24817.md): User can see invitees in events created in PMs and private categories (CVSS 4.3)
- [CVE-2024-23654](https://cve.now/CVE-2024-23654.md): discourse-ai admin-initiated SSRF when interacting with AI services (CVSS 4.1)
- [CVE-2024-26145](https://cve.now/CVE-2024-26145.md): Uninvited user is able to join and mark the attendance of the the private event (CVSS 6.5)
- [CVE-2023-46241](https://cve.now/CVE-2023-46241.md): Potential account take over due to unverified emails from Microsoft Identity Platform (CVSS 9.1)
- [CVE-2024-24755](https://cve.now/CVE-2024-24755.md): discourse-group-membership-ip-block is exposing potentially sensitive custom fields (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/discourse
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.