Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 3 of 7
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27936 · Other software · discourse · reported by GitHubMedium 6.9
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a restriction bypass allows restricted post action counts to be disclosed to non-privileged users through a carefully crafted request. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27935 · Other software · discourse · reported by GitHubMedium 6.9
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a vulnerability in an API endpoint that discloses private topic metadata of admin users to moderator users even if the moderators do not have access to the private topics. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27934 · Other software · discourse · reported by GitHubHigh 8.7
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27740 · Other software · discourse · reported by GitHubMedium 5.1
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a cross-site scripting vulnerability that arises because the system trusts the raw output from an AI Large Language Model (LLM) and renders it using htmlSafe in the Review Queue interface without adequate sanitization. A malicious attacker can use valid Prompt Injection techniques to force the AI to return a malicious payload (e.g., tags). When a Staff member (Admin/Moderator) views the flagged post in the Review Queue, the payload executes. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, temporarily disable AI triage automation scripts.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27570 · Other software · discourse · reported by GitHubMedium 5.1
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the SharedAiConversation model renders the conversation title directly into HTML without proper sanitization. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, tighten access by changing the `ai_bot_public_sharing_allowed_groups` site setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27491 · Other software · discourse · reported by GitHubMedium 6.9
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open-source discussion platform.CVE-2026-27454 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The display_post method called post.revert_to directly without verifying whether the revision was hidden or if the user had permission to view edit history. This meant hidden revisions (intentionally concealed by staff) could be read by any user by simply enumerating version numbers. Starting in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, Discourse looks up the PostRevision and call guardian.ensure_can_see! before reverting, consistent with how the /posts/:id/revisions/:revision endpoint already authorizes access. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Discourse is an open source discussion platform.CVE-2026-27166 · Other software · discourse · reported by GitHubMedium 4.1
Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-28227 · Other software · discourse · reported by GitHubLow 1.2
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-28219 · Other software · discourse · reported by GitHubLow 1.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST request, a regular user can elevate a topic’s status to a site-wide notice or banner, bypassing intended administrative restrictions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. There are no practical workarounds to prevent this behavior other than applying the security patch. Administrators concerned about unauthorized promotions should audit recent changes to site banners and global notices until the fix is deployed.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-28218 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions on each Data Explorer query that doesn't have permissions, or disable discourse-data-explorer plugin.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27154 · Other software · discourse · reported by GitHubLow 1.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27153 · Other software · discourse · reported by GitHubLow 1.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export endpoint by exploiting an overly permissive allowlist in `can_export_entity?`. The method allowed moderators to export any entity not explicitly blocked instead of restricting to an explicit allowlist. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27162 · Other software · discourse · reported by GitHubMedium 4.9
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use `Post.secured(guardian)` to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27152 · Other software · discourse · reported by GitHubLow 1.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat::AddUsersToChannel` — a user could add targets who have blocked/ignored/muted them to an existing DM channel, bypassing per-recipient PM restrictions that are enforced during DM channel creation. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27151 · Other software · discourse · reported by GitHubLow 1.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27150 · Other software · discourse · reported by GitHubLow 1.3
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27149 · Other software · discourse · reported by GitHubMedium 4.9
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-27021 · Other software · discourse · reported by GitHubMedium 6.9
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-26979 · Other software · discourse · reported by GitHubNone
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-26973 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging to a category moderation group can create or delete their own notes on **any** reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped `Reviewable.find` and the `ensure_can_see` guard only checked whether the user could access the review queue in general, not whether they could access the specific reviewable. Only instances with `enable_category_group_moderation` enabled are affected. Staff users (admins/moderators) are not impacted as they already have access to all reviewables. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by scoping the reviewable lookup through `Reviewable.viewable_by(current_user)`. As a workaround, disable the `enable_category_group_moderation` site setting. This removes the attack surface as only staff users will have access to the review queue.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-26265 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The `user_field_ids` parameter in `DirectoryItemsController#index` accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (`show_on_profile` / `show_on_user_card`) that are enforced elsewhere (e.g., `UserCardSerializer` via `Guardian#allowed_user_field_ids`). An attacker can request `GET /directory_items.json?period=all&user_field_ids=<id>` with any private field ID and receive that field's value for every user in the directory response. This enables bulk exfiltration of private user data such as phone numbers, addresses, or other sensitive custom fields that admins have explicitly configured as non-public. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by filtering `user_field_ids` against `UserField.public_fields` for non-staff users before building the custom field map. As a workaround, site administrators can remove sensitive data from private user
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-26207 · Other software · discourse · reported by GitHubMedium 5.4
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyController` loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private categories or PMs they cannot see and any authenticated user to enumerate which post IDs have policies attached via differentiated error responses (information disclosure). The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by adding a `guardian.can_see?(@post)` check in the `set_post` before_action, ensuring post visibility is verified before any policy action is processed. As a workaround, disabling the discourse-policy plugin (`policy_enabled = false`) eliminates the vulnerability. There is no other workaround without upgrading.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-26078 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization. This vulnerability is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0. The fix rejects webhook requests when the webhook secret is not configured, preventing signature forgery with an empty key. As a workaround, configure the `patreon_webhook_secret` site setting with a strong, non-empty secret value. When the secret is non-empty, an attacker cannot forge valid signatures without knowing the secret.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Discourse is an open source discussion platform.CVE-2026-26077 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2026-24742 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This allows moderators to bypass intended access controls and extract confidential data by monitoring the staff action logs. With leaked webhook secrets, an attacker could potentially spoof webhook events to integrated services. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site administrators should review and limit moderator appointments to fully trusted users. There is no configuration-based workaround to prevent this access.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2026-23743 · Other software · discourse · reported by GitHubMedium 6.9
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resources (private topics, categories, posts, or hidden tags) were redirecting users to URLs containing the resource slug, even when the user didn't have access to view the resource. This leaked potentially sensitive information (e.g., private topic titles) via the redirect Location header and the 404 page's search box. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2026-21865 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages to public topics when they shouldn't have access. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site admin can temporarily revoke the moderation role from untrusted moderators or remove the moderator group from the "personal message enabled groups" site setting until the Discourse instance has been upgraded to a version that has been patched.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-69289 · Other software · discourse · reported by GitHubMedium 5.1
Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the "require_change_email_confirmation" setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-69218 · Other software · discourse · reported by GitHubHigh 7.1
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments that moderators should not have access to. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. There is no workaround. Limit moderator privileges to trusted users until the patch is applied.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68934 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause O(n^2) processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as the shared worker pool becomes exhausted. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Lowering the max_draft_length site setting reduces attack surface but does not fully mitigate the issue, as payloads under the limit can still trigger the slow code path.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68933 · Other software · discourse · reported by GitHubMedium 6.9
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites that grant moderators post ownership transfer permissions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The patch adds visibility checks for both the topic and posts before allowing ownership transfer. As a workaround, disable the `moderators_change_post_ownership` site setting to prevent non-admin moderators from using the post ownership transfer feature.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68666 · Other software · discourse · reported by GitHubMedium 5.9
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. To work around this problem, a site admin can temporarily revoke the moderation role from all moderators until the Discourse instance has been upgraded to a version that has been patched.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68662 · Other software · discourse · reported by GitHubHigh 7.6
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68660 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass the ai_discover_persona access controls and gain ongoing DM access to personas that may be wired to staff-only categories, RAG document sets, or automated tooling, enabling unauthorized data disclosure. Because the controller also accepts arbitrary user_id, an attacker can impersonate other accounts to trigger unwanted AI conversations on their behalf, generating confusing or abusive PM traffic. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68659 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and resource exhaustion by sending large JSON payloads to the username preference endpoint PUT /u//preferences/username, resulting in degraded performance for other users and endpoints. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-68479 · Other software · discourse · reported by GitHubHigh 7.1
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-67723 · Other software · discourse · reported by GitHubMedium 4.6
Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Discourse is an open source discussion platform.CVE-2025-66488 · Other software · discourse · reported by GitHubMedium 4.6
Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml files for uploads in authorized_extensions. For existing html xml uploads, site owners can consider deleting them.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025Discourse is an open source discussion platform.CVE-2025-64528 · Other software · discourse · reported by GitHubMedium 6.3
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2025WP Discourse: Information ExposureCVE-2025-11983 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditionally sending Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization. This makes it possible for authenticated attackers, with author-level access and above, to exfiltrate sensitive Discourse API credentials to attacker-controlled servers, as well as query internal services and potentially perform further attacks.
- Product
- WP Discourse
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update WP Discourse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2025Discourse is an open source discussion platform.CVE-2025-61598 · Other software · discourse · reported by GitHubMedium 6.3
Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Discourse is an open-source community discussion platform.CVE-2025-59337 · Other software · discourse · reported by GitHubMedium 5.5
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Discourse is an open-source community discussion platform.CVE-2025-58055 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topic_id” value in API requests to the AI suggestion endpoints, users could target specific restricted topics. The AI model’s responses then disclosed information that the authenticated user couldn’t normally access. This issue is fixed in version 3.5.1. To workaround this issue, users can restrict group access to the AI helper feature through the "composer_ai_helper_allowed_groups" and "post_ai_helper_allowed_groups" site settings.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Discourse is an open-source community discussion platform.CVE-2025-58054 · Other software · discourse · reported by GitHubLow 3.5
Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025Discourse is an open-source discussion platform.CVE-2025-54411 · Other software · discourse · reported by GitHubLow 2.4
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This vulnerability is fixed in 3.5.0.beta8.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Discourse is an open-source community discussion platform.CVE-2025-53102 · Other software · discourse · reported by GitHubHigh 8.2
Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Discourse is an open-source discussion platform.CVE-2025-49845 · Other software · discourse · reported by GitHubMedium 6.3
Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been discovered that users of versions prior to 3.4.6 on the `stable` branch and prior to 3.5.0.beta8-dev on the `tests-passed` branch can continue to see their own whispers even after losing visibility of posts typed `whisper`. This issue is patched in versions 3.4.6 and 3.5.0.beta8-dev. No known workarounds are available.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Discourse is an open-source discussion platform.CVE-2025-48954 · Other software · discourse · reported by GitHubHigh 8.1
Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Discourse is an open-source discussion platform.CVE-2025-48877 · Other software · discourse · reported by GitHubHigh 8.1
Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. As a workaround, the Codepen prefix can be removed from a site's `allowed_iframes`.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.