Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33415Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure
- CVE-2026-33300Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
- CVE-2026-33185Discourse: Group SMTP test endpoint susceptible to SSRF
- CVE-2026-33074Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions
- CVE-2026-32951Discourse: Authorization bypass in oneboxer via user-controlled category id
- CVE-2026-32620Discourse: Missing post-level authorization allows whisper metadata disclosure
- CVE-2026-32619Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories
- CVE-2026-32618Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id
- CVE-2026-32615Discourse: Category group moderators can perform actions on topics in restricted categories without read access
- CVE-2026-32607Discourse: Stored XSS via unescaped assignee name
- CVE-2026-32273Discourse: XSS on category description update via API
- CVE-2026-32243Discourse: Stored XSS in discourse-ai shared conversations onebox
- CVE-2026-32113Discourse: Open redirect via `sso_destination_url` cookie in `enter`
- CVE-2026-32143Discourse: Admin-only report can be exported by moderators
- CVE-2026-33073discourse-subscriptions plugin leaking stripe API key in multisite environment
- CVE-2026-33428Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership
- CVE-2026-33427Discourse Authorization Page Displays Unvalidated Redirect Domain
- CVE-2026-33426Discourse users can edit or synonymize hidden tags they can't see
- CVE-2026-33425Discourse has inferable private group membership or existence via exclude_groups parameter
- CVE-2026-33424PM access granted through invites after access revocation
- CVE-2026-33423Discourse staff can modify any user's group notification level
- CVE-2026-33422Discourse exposes ip_address of flagged user
- CVE-2026-33411Discourse's solved topic stream has potential stored XSS in topic title
- CVE-2026-33291Discourse user can create Zendesk tickets even when it does not have access to topic
- CVE-2026-33251Discourse has a Hidden Solved topics permission bypass
- CVE-2026-32114Discourse's unscoped status lookups leak restricted metadata
- CVE-2026-31869Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check
- CVE-2026-31805Discourse has a poll authorization bypass via post_id array parameter
- CVE-2026-30891Discourse hasUnauthorized Exposure of Private User Action Types
- CVE-2026-30889Discourse has Unauthorized Post Data Exposure in discourse-user-notes