Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-26973Discourse doesn't scope reviewable notes to user-visible reviewables
- CVE-2026-26265Discourse has IDOR vulnerability in the directory items endpoint
- CVE-2026-26207DIscourse's discourse-policy plugin lacks post access check
- CVE-2026-26078Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint
- CVE-2026-26077Discourse doesn't ensure webhooks require a token
- CVE-2026-24742Discourse staff action logs expose sensitive information to moderators
- CVE-2026-23743Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users
- CVE-2026-21865Discourse topic conversion permission vulnerability for moderators
- CVE-2025-69289Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change
- CVE-2025-69218Discourse moderators can access admin-only reports exposing private upload URLs
- CVE-2025-68934Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
- CVE-2025-68933Discourse non-admin moderators can exfiltrate private content via post ownership transfer
- CVE-2025-68666Discourse users archives leaked to users with moderation privileges
- CVE-2025-68662FinalDestination hostname matching allows SSRF protection bypass
- CVE-2025-68660Discourse AI Discover's continue conversation allows threat actor to impersonate user
- CVE-2025-68659Discourse has DoS vulnerability in username change endpoint
- CVE-2025-68479Discourse subscriptions are susceptible to takeover
- CVE-2025-67723Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin
- CVE-2025-66488Discourse allows script execution in uploaded HTML/XML files on S3
- CVE-2025-64528Users are able to find users by name even when `enable_names` is off
- CVE-2025-61598Discourse is missing Cache-Control response header on error responses
- CVE-2025-59337Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments
- CVE-2025-58055Discourse AI Suggestions Contain Insecure Direct Object Reference
- CVE-2025-58054Discourse is vulnerable to XSS when quoting chat messages
- CVE-2025-54411Discourse welcome banner user name XSS
- CVE-2025-53102Discourse's WebAuthn challenge isn't cleared from user session after authentication
- CVE-2025-49845Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers
- CVE-2025-48954Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow
- CVE-2025-48877Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe
- CVE-2025-48062Discourse vulnerable to HTML injection when inviting to topic via email