Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-30888Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint
- CVE-2026-33408Discourse has Improper Authorization in "Post Edits" Report For Moderators
- CVE-2026-33395Discourse has stored click‑based XSS via Graphviz SVG javascript: links
- CVE-2026-33394Discourse leaks PM post edits to moderators
- CVE-2026-33393Discourse fixes loose hostname matching in spam host allowlist
- CVE-2026-33355Discourse filters whisper posts from private-posts feed
- CVE-2026-33410Discourse hardens chat DM channel creation and expansion
- CVE-2026-32099Discourse prevents hidden profile data leak via user onebox
- CVE-2026-29072Discourse missing permission check for policy creation in discourse-policy
- CVE-2026-28282Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin
- CVE-2026-27936Discourse discloses restricted post-action counts to non-privileged users
- CVE-2026-27935Discourse leaks private topic metadata to non-authorized users
- CVE-2026-27934Discourse leaks private topic title and post excerpt via user action API endpoint
- CVE-2026-27740Discourse has Stored XSS in AI Triage Automation
- CVE-2026-27570Discourse Vulnerable to Stored XSS via Shared AI Conversation Onebox
- CVE-2026-27491Discourse has a bypass of official warnings messages by non-staff users
- CVE-2026-27454Discourse has check revision visibility on posts endpoint
- CVE-2026-27166Discourse vulnerable to HTML injection via prohibited iframe URLs
- CVE-2026-28227Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category
- CVE-2026-28219Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners
- CVE-2026-28218Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution
- CVE-2026-27154Discourse has XSS when editing a malicious post
- CVE-2026-27153Discourse doesn't prevent moderators from exporting user Chat DMs
- CVE-2026-27152DIscourse has DM communication-preference bypass when adding members
- CVE-2026-27162DIscourse doesn't prevent whispers to leak in excerpts
- CVE-2026-27151Discourse doesn't validate destination topic when moving posts
- CVE-2026-27150Discourse doesn't ensure guardian check when creating QueryGroupBookmark
- CVE-2026-27149Discourse has SQL injection in PM tag filtering
- CVE-2026-27021Discourse: Poll voters endpoint lacked post visibility checks
- CVE-2026-26979Discourse: TL4 users are able to change status of restricted topics