Discourse vulnerabilities

Discourse is an open-source discussion platform where group owners, who are not necessarily admins or moderators, can view SMTP credentials in plaintext. This affects versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1.

A vulnerability in the Discourse discussion platform allows authenticated users outside the configured groups to post into staff-only whisper channels. This issue affects versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1.

Discourse is an open-source discussion platform that has a bug in the serialization of the :name attribute in GroupPostSerializer. The issue is that the incorrectly named predicate include_user_long_name? was never called, resulting in object.user.name always being serialized regardless of SiteSetting.enable_names.

Discourse is an open-source discussion platform with a vulnerability in versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1. The ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts arriving via email, allowing moderation group members to access the full email source without proper permissions.

Discourse is an open-source discussion platform that, in versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1, discloses whisper translation audit logs through bot debug endpoints. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Discourse prior to versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 contains a vulnerability in the discourse-subscriptions plugin that allows users to gain access to subscription-gated groups without completing payment.

Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1 allow an authenticated user to read the name and structured content of form templates intended exclusively for categories they are not authorized to access.

Discourse prior to versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1 caches outdated AI summaries that can leak removed content to anonymous and unprivileged users.

Discourse, an open-source discussion platform, has a vulnerability that exposes staged user custom fields and usernames on public invite pages without email verification. This affects versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0.

Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 have an authorization bypass vulnerability. Unauthenticated or unauthorized users can view staff-only tags and associated data.

Discourse, an open-source discussion platform, has a vulnerability in a sentiment analytics endpoint. An authenticated moderator-level user can retrieve post content, topic titles, and usernames from unauthorized categories. The issue is fixed in versions 2026.1.3, 2026.2.2, and 2026.3.0.

An authorization bypass in Discourse's Category Chatables controller allows moderators to get information about hidden groups and user counts.

Discourse has a vulnerability in the group email settings test endpoint that allows initiating outbound connections to arbitrary hosts and ports. The endpoint was accessible to non-staff group owners.

Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allow a user to purchase a lower tier subscription but gain benefits associated with a higher tier subscription.

Discourse with the discourse-subscriptions plugin from versions 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 leaks Stripe API keys across sites in a multisite cluster, potentially exposing Stripe-related information across sites.

Discourse allows an authenticated user to obtain shared draft topic titles by sending an inline onebox request with a matching category_id.

Discourse allows non-staff users to access read receipt information for staff-only posts. Metadata (who read and when) is exposed, but not post content.

Discourse versions before 2026.1.3, 2026.2.2, and 2026.3.0 allow users who lost access to a topic to still interact with polls, including voting and toggling status.

Discourse allows inference of chat channel membership from user search without proper authorization.

In the Discourse discussion platform, versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allowed category group moderators to perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

In Discourse, when the hidden 'prioritize_full_name_in_ux' setting is enabled, user and group display names are rendered without HTML escaping in several assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic.

In Discourse, updating a category description via API does not sanitize the description string, which can lead to XSS attacks. This affects versions from 2026.1.0 before 2026.1.3, 2026.2.0 before 2026.2.2, and 2026.3.0 before 2026.3.0.

In Discourse, an attacker with the ability to create shared AI conversations can inject arbitrary HTML and JavaScript via crafted conversation titles. The payload executes in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim.

In Discourse, moderators can export CSV data from admin-restricted reports, bypassing visibility restrictions. This could expose sensitive operational data.

Discourse has a vulnerability in the enter action of StaticController that reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. Cookies are client-controlled and can be set by attackers.

Discourse is an open source discussion platform. Versions before 3.6.2 and 3.6.0.beta2 were missing the default Cache-Control response header (no-store, no-cache) on error responses. This may cause unintended caching by proxies, potentially leading to cache poisoning attacks.

Discourse versions 3.5.0 and below allow malicious meta-commands to be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. The issue is fixed in version 3.5.1.

Discourse versions 3.5.0 and below allow authenticated users to extract information about topics they are not authorized to access by modifying the topic_id value in requests to the AI suggestion endpoints (Title, Category, Tags).

Discourse versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1.

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, unauthorized users could obtain information about restricted-visibility topic tags.

Discourse is an open source discussion platform that prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches did not impose an upper limit on limit parameters in multiple controller actions. This lack of restriction may allow users to generate database queries that could exhaust server resources.

Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can delay the defer queue processing on sites hosted in the same multisite installation.

Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason.

Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in versions 3.0.6 and 3.1.0.beta7.

In the Discourse discussion platform prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered that could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous users. Version 3.1.0.beta7 contains a patch.

Discourse is an open source discussion platform with a vulnerability that can cause a denial of service when attempting to create or update a custom sidebar section. This issue has been patched in commit `52b003d915`.

Discourse is an open source discussion platform that has a vulnerability allowing users to bypass topic title validations when editing topics. The issues involve title length, number of emojis in the title, and blank topic titles.

Discourse, an open source discussion platform, has a nonce reuse vulnerability in its Content Security Policy (CSP) that could allow XSS attacks to bypass CSP protection. Currently, there are no known XSS vectors, but if one is discovered, this vulnerability would allow XSS attacks to completely bypass CSP.

Discourse is an open source discussion platform, where prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of recently created topics in categories they didn't have access to.