# discourse.

Every CVE that names discourse among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Discourse vulnerable to Cross-site Scripting through pending post titles descriptions](https://agentprime.io/advisories/CVE-2023-22454.md)
  `CVE-2023-22454` · CVE record: discourse discourse · CVSS 8.0 High · Not analysed yet · Published 5 Jan 2023 · Tags: Cross-site scripting (XSS)
- [Discourse vulnerable to exposure of user post counts per topic to unauthorized users](https://agentprime.io/advisories/CVE-2023-22453.md)
  `CVE-2023-22453` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 5 Jan 2023 · Tags: Information disclosure
- [Discourse password reset link can lead to in account takeover if user changes to a new email](https://agentprime.io/advisories/CVE-2022-46177.md)
  `CVE-2022-46177` · CVE record: discourse discourse · CVSS 5.7 Medium · Not analysed yet · Published 5 Jan 2023 · Tags: Authentication bypass
- [Discourse vulnerable to private topic leak via email#send_digest](https://agentprime.io/advisories/CVE-2022-23546.md)
  `CVE-2022-23546` · CVE record: discourse discourse · CVSS 5.5 Medium · Not analysed yet · Published 5 Jan 2023 · Tags: Information disclosure
- [Group SMTP user emails are exposed in CC email header](https://agentprime.io/advisories/CVE-2022-46168.md)
  `CVE-2022-46168` · CVE record: discourse discourse · CVSS 3.5 Low · Not analysed yet · Published 5 Jan 2023 · Tags: Information disclosure
- [Discourse vulnerable to bypass of post max_length using HTML comments](https://agentprime.io/advisories/CVE-2022-23549.md)
  `CVE-2022-23549` · CVE record: discourse discourse · CVSS 5.7 Medium · Not analysed yet · Published 5 Jan 2023 · Tags: CWE-20
- [Regular expression denial of service in discourse](https://agentprime.io/advisories/CVE-2022-23548.md)
  `CVE-2022-23548` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 5 Jan 2023 · Tags: Denial of service
- [Any authenticated Discourse user can create an unlisted topic](https://agentprime.io/advisories/CVE-2022-46159.md)
  `CVE-2022-46159` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2022 · Tags: Denial of service
- [Discourse may allow exposure of hidden tags in the subject of notification emails](https://agentprime.io/advisories/CVE-2022-46150.md)
  `CVE-2022-46150` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2022 · Tags: Information disclosure
- [Discourse allows self-XSS through malicious composer message](https://agentprime.io/advisories/CVE-2022-46148.md)
  `CVE-2022-46148` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 29 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Discourse users can see notifications for topics they no longer have access to](https://agentprime.io/advisories/CVE-2022-41944.md)
  `CVE-2022-41944` · CVE record: discourse discourse · CVSS 3.5 Low · Not analysed yet · Published 28 Nov 2022 · Tags: Information disclosure
- [Discourse chat messages should have a maximum character limit](https://agentprime.io/advisories/CVE-2022-41921.md)
  `CVE-2022-41921` · CVE record: discourse discourse · CVSS 3.5 Low · Not analysed yet · Published 28 Nov 2022 · Tags: CWE-20
- [Users erroneously and transparently added to private messages in Discourse](https://agentprime.io/advisories/CVE-2022-39385.md)
  `CVE-2022-39385` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 14 Nov 2022 · Tags: Information disclosure
- [Displaying user badges can leak topic titles to users that have no access to the topic](https://agentprime.io/advisories/CVE-2022-39378.md)
  `CVE-2022-39378` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2022 · Tags: Information disclosure
- [Discourse user account takeover via email and invite link](https://agentprime.io/advisories/CVE-2022-39356.md)
  `CVE-2022-39356` · CVE record: discourse discourse · CVSS 8.9 High · Not analysed yet · Published 2 Nov 2022 · Tags: Broken access control
- [Possible Server-Side Request Forgery (SSRF) in webhooks](https://agentprime.io/advisories/CVE-2022-39241.md)
  `CVE-2022-39241` · CVE record: discourse discourse · CVSS 7.6 High · Not analysed yet · Published 2 Nov 2022 · Tags: Server-side request forgery (SSRF)
- [Discourse vulnerable to incomplete quote causing a topic to crash in the browser](https://agentprime.io/advisories/CVE-2022-39232.md)
  `CVE-2022-39232` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2022 · Tags: CWE-20
- [Discourse user profile location and website fields were not sufficiently length-limited](https://agentprime.io/advisories/CVE-2022-39226.md)
  `CVE-2022-39226` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2022 · Tags: Denial of service, CWE-20
- [Discourse moderators can edit themes via the API](https://agentprime.io/advisories/CVE-2022-36068.md)
  `CVE-2022-36068` · CVE record: discourse discourse · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2022 · Tags: Broken access control
- [Discourse vulnerable to RCE via admins uploading maliciously zipped file](https://agentprime.io/advisories/CVE-2022-36066.md)
  `CVE-2022-36066` · CVE record: discourse discourse · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2022 · Tags: Unrestricted file upload
- [Email activation route can be abused by spammers in Discourse](https://agentprime.io/advisories/CVE-2022-31184.md)
  `CVE-2022-31184` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 1 Aug 2022 · Tags: Denial of service
- [Cache poisoning via maliciously-formed request in Discourse](https://agentprime.io/advisories/CVE-2022-31182.md)
  `CVE-2022-31182` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2022 · Tags: Denial of service
- [Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse](https://agentprime.io/advisories/CVE-2022-31096.md)
  `CVE-2022-31096` · CVE record: discourse discourse · CVSS 5.7 Medium · Not analysed yet · Published 27 Jun 2022 · Tags: CWE-281
- [Banner topic data is exposed on login-required Discourse sites](https://agentprime.io/advisories/CVE-2022-31060.md)
  `CVE-2022-31060` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 14 Jun 2022 · Tags: Information disclosure
- [Invite bypasses user approval in Discourse](https://agentprime.io/advisories/CVE-2022-31025.md)
  `CVE-2022-31025` · CVE record: discourse discourse · CVSS 2.6 Low · Not analysed yet · Published 3 Jun 2022 · Tags: Broken access control
- [Category group permissions leaked in Discourse](https://agentprime.io/advisories/CVE-2022-24850.md)
  `CVE-2022-24850` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2022 · Tags: Information disclosure
- [Anonymous user cache poisoning in discourse](https://agentprime.io/advisories/CVE-2022-24824.md)
  `CVE-2022-24824` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2022 · Tags: CWE-829
- [Private group name exposure in discourse](https://agentprime.io/advisories/CVE-2022-24804.md)
  `CVE-2022-24804` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 11 Apr 2022 · Tags: Information disclosure
- [Secure category names leaked via user activity export in Discourse](https://agentprime.io/advisories/CVE-2022-24782.md)
  `CVE-2022-24782` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 24 Mar 2022 · Tags: Information disclosure
- [Denial of Service in Discourse](https://agentprime.io/advisories/CVE-2022-23641.md)
  `CVE-2022-23641` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 15 Feb 2022 · Tags: Denial of service
- [Group advanced search option may leak group and group's members visibility](https://agentprime.io/advisories/CVE-2022-21677.md)
  `CVE-2022-21677` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2022 · Tags: Information disclosure
- [User can bypass approval when invited to Discourse](https://agentprime.io/advisories/CVE-2022-21684.md)
  `CVE-2022-21684` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 13 Jan 2022 · Tags: Authentication bypass
- [User's bio visible even if profile is restricted in Discourse](https://agentprime.io/advisories/CVE-2022-21678.md)
  `CVE-2022-21678` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 13 Jan 2022 · Tags: Information disclosure
- [Exposure of whisper participants in discourse](https://agentprime.io/advisories/CVE-2022-21642.md)
  `CVE-2022-21642` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 5 Jan 2022 · Tags: Information disclosure
- [Denial of Service in discourse](https://agentprime.io/advisories/CVE-2021-43850.md)
  `CVE-2021-43850` · CVE record: discourse discourse · CVSS 6.8 Medium · Not analysed yet · Published 4 Jan 2022 · Tags: CWE-20
- [Bypass of Poll voting limits in Discourse](https://agentprime.io/advisories/CVE-2021-43793.md)
  `CVE-2021-43793` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 1 Dec 2021 · Tags: Privilege escalation
- [Anonymous user cache poisoning via development-mode header in Discourse](https://agentprime.io/advisories/CVE-2021-43794.md)
  `CVE-2021-43794` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 1 Dec 2021 · Tags: CWE-610
- [Notifications leak in Discourse](https://agentprime.io/advisories/CVE-2021-43792.md)
  `CVE-2021-43792` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 1 Dec 2021 · Tags: Information disclosure
- [Cache poisoning via maliciously-formed request in discourse](https://agentprime.io/advisories/CVE-2021-41271.md)
  `CVE-2021-41271` · CVE record: discourse discourse · CVSS 4.8 Medium · Not analysed yet · Published 15 Nov 2021 · Tags: Information disclosure
- [RCE via malicious SNS subscription payload](https://agentprime.io/advisories/CVE-2021-41163.md)
  `CVE-2021-41163` · CVE record: discourse discourse · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 20 Oct 2021 · Tags: Other injection
- [XSS via blocked watched word in error message](https://agentprime.io/advisories/CVE-2021-41095.md)
  `CVE-2021-41095` · CVE record: discourse discourse · CVSS 4.2 Medium · Not analysed yet · Published 27 Sept 2021 · Tags: Cross-site scripting (XSS)
- [Private message title and participating users leaked in discourse](https://agentprime.io/advisories/CVE-2021-41082.md)
  `CVE-2021-41082` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2021 · Tags: Information disclosure
- [Cross-site scripting via category name in Discourse](https://agentprime.io/advisories/CVE-2021-39161.md)
  `CVE-2021-39161` · CVE record: discourse discourse · CVSS 4.4 Medium · Not analysed yet · Published 26 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Information exposure in Discourse](https://agentprime.io/advisories/CVE-2021-37703.md)
  `CVE-2021-37703` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 13 Aug 2021 · Tags: Information disclosure
- [Re-use of email tokens in Discourse](https://agentprime.io/advisories/CVE-2021-37693.md)
  `CVE-2021-37693` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2021 · Tags: Authentication bypass, CWE-640
- [XSS via d-popover and d-html-popover attribute](https://agentprime.io/advisories/CVE-2021-37633.md)
  `CVE-2021-37633` · CVE record: discourse discourse · CVSS 7.4 High · Not analysed yet · Published 9 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Post creator of a whisper post can be revealed to non-staff users in Discourse](https://agentprime.io/advisories/CVE-2021-32788.md)
  `CVE-2021-32788` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 27 Jul 2021 · Tags: Information disclosure
- [YouTube Onebox susceptible to XSS](https://agentprime.io/advisories/CVE-2021-32764.md)
  `CVE-2021-32764` · CVE record: discourse discourse · CVSS 8.1 High · Not analysed yet · Published 15 Jul 2021 · Tags: Cross-site scripting (XSS)
- [Discourse: Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when…](https://agentprime.io/advisories/CVE-2019-1020018.md)
  `CVE-2019-1020018` · CVE record: Discourse · No CVSS score · Not analysed yet · Published 29 Jul 2019
- [Discourse: Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when…](https://agentprime.io/advisories/CVE-2019-1020017.md)
  `CVE-2019-1020017` · CVE record: Discourse · No CVSS score · Not analysed yet · Published 29 Jul 2019

Newest: <https://agentprime.io/advisories/technology/discourse.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=discourse&cursor=WyIyMDIzLTAxLTA1VDIwOjAyOjQwLjYwODAwMFoiLCJDVkUtMjAyMy0yMjQ1NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/discourse/?cursor=WyIyMDIzLTAxLTA1VDIwOjAyOjQwLjYwODAwMFoiLCJDVkUtMjAyMy0yMjQ1NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.