Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-72722Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
- CVE-2026-72721Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
- CVE-2026-72720Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
- CVE-2026-45780Discourse: Private event sample invitees are serialized to non-invited event viewers
- CVE-2026-53963Discourse: Stored-XSS in 2FA delete confirmation modal
- CVE-2026-59828Discourse: Hidden post revisions leak through adjacent visible diffs
- CVE-2026-44787Discourse: Signup-time primary_group_id assignment grants whisperer access
- CVE-2026-53962Discourse: Insufficient SVG sanitization logic
- CVE-2026-55424Discourse: Topic featured link susceptible to stored XSS
- CVE-2026-45788Discourse: Secure uploads exposed by hotlinked image copying
- CVE-2026-49256Discourse: Hidden tag names leaked via category serializers
- CVE-2026-46413Discourse: Regular users can route multipart uploads into the admin backup store
- CVE-2026-53961Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
- CVE-2026-55420Discourse: Remote code execution via pdf uploads
- CVE-2026-47264Discourse: Don't leak restricted tag group names via tag info
- CVE-2026-47263Discourse: Prevent webhook payload disclosure on event redelivery
- CVE-2026-45775Discourse: Cross-site backup access via path traversal in multisite local backups
- CVE-2026-45085Discourse: Chat misauthorization and information disclosure
- CVE-2026-44785Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-44784Discourse: Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44783Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44782Discourse: GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44780Discourse: Category queue reviewers can read raw incoming emails from queued posts
- CVE-2026-44779Discourse: Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44786Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-34154Discourse has a subscription access bypass in its discourse-subscriptions plugin
- CVE-2026-33514Discourse: Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-32244Discourse: Cached outdated summaries can leak removed content
- CVE-2026-34947Discourse: Staged user custom fields are exposed on public invite pages
- CVE-2026-27481Discourse: Hidden tag visibility bypass on tag routes