Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-48053Discourse vulnerable to DoS via large URL payload in PM to a bot
- CVE-2025-47288Discourse Policy plugin private group members visible
- CVE-2025-46824Discourse Code Review Plugin vulnerable to XSS via auto link commits
- CVE-2025-46813Private data leak on login-required Discourse sites
- CVE-2025-32376Discourse DM limits aren’t always properly enforced
- CVE-2025-24972Discourse may bypass user preference when adding users to chat groups
- CVE-2025-24808Discourse has race condition when adding users to a group DM
- CVE-2024-53266Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse
- CVE-2024-53851Partial denial of service via inline oneboxes in Discourse
- CVE-2024-53994Potential bypass of chat permissions in Discourse
- CVE-2024-55948Anonymous cache poisoning via XHR requests in Discourse
- CVE-2024-56197Users can see other user's tagged PMs in Discourse
- CVE-2024-56328HTMLi(XSS without CSP) via Onebox urls in Discourse
- CVE-2025-22601Client Side Path Traversal using activate account route in Discourse
- CVE-2025-22602Stored DOM-based XSS (without CSP) via video placeholders in Discourse
- CVE-2025-23023Anonymous cache poisoning via request headers in Discourse
- CVE-2024-54142Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse
- CVE-2024-49765Bypass of Discourse Connect using other login paths if enabled in Discourse
- CVE-2024-52589Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse
- CVE-2024-52794Magnific lightbox susceptible to Cross-site Scripting in Discourse
- CVE-2024-53991Potential Backup file leaked via Nginx in Discourse
- CVE-2024-47773Anonymous cache poisoning via XHR requests in Discourse
- CVE-2024-47772Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse
- CVE-2024-43789Denial of service by the absence of restrictions on replies to posts in Discourse
- CVE-2024-45297Prevent topic list filtering by hidden tags for unauthorized users in Discourse
- CVE-2024-45051Bypass of email address validation via encoded email addresses in Discourse
- CVE-2024-45303Discourse Calendar plugin event names susceptible to XSS
- CVE-2024-21658Insufficient control of region value length in discourse-calendar
- CVE-2024-43408Discourse Placeholder Forms has a XSS stopped by CSP
- CVE-2024-39320Discourse allows iframe injection though default site setting