Discourse
Page 2 of 3 — Discourse CVEs from a corpus of 279, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26973 | Medium | 4.3 | 2026-02-26 | Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `Review… |
CVE-2026-26265 | High | 7.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint all… |
CVE-2026-26207 | Medium | 5.4 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user t… |
CVE-2026-26078 | High | 7.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank… |
CVE-2026-26077 | Medium | 6.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, P… |
CVE-2026-24742 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive inform… |
CVE-2026-23743 | High | 7.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resou… |
CVE-2026-21865 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages… |
CVE-2025-69289 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a n… |
CVE-2025-69218 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin… |
CVE-2025-68934 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payload… |
CVE-2025-68933 | Medium | 6.9 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_chan… |
CVE-2025-68666 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with mode… |
CVE-2025-68662 | High | 7.6 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestinatio… |
CVE-2025-68660 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass… |
CVE-2025-68659 | Medium | 4.3 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulner… |
CVE-2025-68479 | High | 7.1 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checki… |
CVE-2025-67723 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-sit… |
CVE-2025-66488 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses… |
CVE-2025-64528 | Medium | 5.3 | 2025-12-30 | Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user… |
CVE-2025-61598 | Medium | 5.3 | 2025-10-28 | Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was… |
CVE-2025-59337 | Medium | 6.8 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed… |
CVE-2025-58055 | Medium | 4.3 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, an… |
CVE-2025-58054 | Low | 3.5 | 2025-10-01 | Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel… |
CVE-2025-54411 | Medium | 5.4 | 2025-08-19 | Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user th… |
CVE-2025-53102 | Critical | 9.8 | 2025-07-29 | Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch… |
CVE-2025-49845 | High | 7.5 | 2025-06-25 | Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only use… |
CVE-2025-48954 | High | 8.1 | 2025-06-25 | Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't en… |
CVE-2025-48877 | Critical | 9.8 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-48062 | High | 7.1 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-48053 | High | 7.5 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-47288 | Low | 3.5 | 2025-05-29 | Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic… |
CVE-2025-46824 | Low | 3.1 | 2025-05-07 | The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on u… |
CVE-2025-46813 | Medium | 5.8 | 2025-05-05 | Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 8… |
CVE-2025-32376 | Medium | 4.3 | 2025-04-30 | Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can… |
CVE-2025-24972 | Medium | 4.3 | 2025-03-26 | Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumsta… |
CVE-2025-24808 | Medium | 4.3 | 2025-03-26 | Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about… |
CVE-2024-53994 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some case… |
CVE-2024-53851 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limit… |
CVE-2024-53266 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams… |
CVE-2025-23023 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to… |
CVE-2025-22602 | Medium | 6.5 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting… |
CVE-2025-22601 | Low | 3.1 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username v… |
CVE-2024-56328 | Medium | 6.5 | 2025-02-04 | Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted… |
CVE-2024-56197 | Low | 2.2 | 2025-02-04 | Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option i… |
CVE-2024-55948 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (fo… |
CVE-2024-54142 | Critical | 9.0 | 2025-01-14 | Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML… |
CVE-2024-53991 | High | 7.5 | 2024-12-19 | Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` wh… |
CVE-2024-52794 | Medium | 6.8 | 2024-12-19 | Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the late… |
CVE-2024-52589 | Low | 2.2 | 2024-12-19 | Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn t… |
CVE-2024-49765 | Medium | 5.3 | 2024-12-19 | Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers… |
CVE-2024-47773 | High | 8.2 | 2024-10-08 | Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without an… |
CVE-2024-47772 | Medium | 6.5 | 2024-10-07 | Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted… |
CVE-2024-45297 | Medium | 5.3 | 2024-10-07 | Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has b… |
CVE-2024-45051 | High | 8.2 | 2024-10-07 | Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions… |
CVE-2024-43789 | High | 7.5 | 2024-10-07 | Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can… |
CVE-2024-45303 | Medium | 6.1 | 2024-09-12 | Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to… |
CVE-2024-21658 | Medium | 4.3 | 2024-08-30 | discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is… |
CVE-2024-43408 | Medium | 6.3 | 2024-08-20 | Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability… |
CVE-2024-39320 | Medium | 6.1 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypass… |
CVE-2024-37299 | Medium | 4.9 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availabil… |
CVE-2024-37165 | Medium | 6.3 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some si… |
CVE-2024-38360 | Medium | 4.9 | 2024-07-15 | Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters… |
CVE-2024-37157 | Medium | 6.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-36122 | Low | 2.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-36113 | Medium | 4.9 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.bet… |
CVE-2024-35234 | Medium | 4.2 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacke… |
CVE-2024-35227 | High | 7.5 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing… |
CVE-2024-35168 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in Discourse WP Discourse.This issue affects WP Discourse: from n/a through 2.5.1. |
CVE-2024-31219 | Medium | 4.3 | 2024-04-15 | Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reac… |
CVE-2024-28242 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgroun… |
CVE-2024-27100 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files… |
CVE-2024-27085 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data i… |
CVE-2024-24827 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry… |
CVE-2024-24748 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public categ… |
CVE-2024-24817 | Medium | 4.3 | 2024-02-22 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to versio… |
CVE-2024-23654 | Medium | 4.1 | 2024-02-21 | discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with di… |
CVE-2024-26145 | Medium | 6.5 | 2024-02-21 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private… |
CVE-2023-46241 | Critical | 9.0 | 2024-02-21 | `discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can po… |
CVE-2024-24755 | Medium | 4.3 | 2024-02-01 | discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip… |
CVE-2024-23834 | Medium | 6.3 | 2024-01-30 | Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only… |
CVE-2024-21655 | Medium | 4.3 | 2024-01-12 | Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause… |
CVE-2023-49099 | Low | 3.1 | 2024-01-12 | Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users ev… |
CVE-2023-49098 | Low | 3.5 | 2024-01-12 | Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerab… |
CVE-2023-48297 | High | 8.6 | 2024-01-12 | Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very… |
CVE-2023-47121 | Low | 3.4 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-47120 | High | 7.5 | 2023-11-10 | Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.be… |
CVE-2023-47119 | Medium | 5.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-46130 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45816 | Low | 3.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45806 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45131 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issu… |
CVE-2023-44391 | Medium | 5.3 | 2023-10-16 | Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is… |
CVE-2023-44388 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the ser… |
CVE-2023-43814 | Low | 3.7 | 2023-10-16 | Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` e… |
CVE-2023-43659 | High | 8.0 | 2023-10-16 | Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email pr… |
CVE-2023-43658 | High | 8.0 | 2023-10-16 | dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper e… |
CVE-2023-45147 | Medium | 4.9 | 2023-10-16 | Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of th… |
CVE-2023-44384 | Medium | 4.1 | 2023-10-06 | Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make a… |
CVE-2023-43657 | High | 7.2 | 2023-09-28 | discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross… |