Advisories · Technology
Discourse.
Every CVE that names Discourse among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
- Discourse
- Cross-site scripting (XSS)
- CVSS 7.5 High
Discourse: Media uploads remain publicly accessible after category permissions are restricted
- discourse
- Information disclosure
- Broken access control
- CVSS 7.5 High
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- discourse
- Broken access control
- CVSS 7.7 High
Discourse: Stored oEmbed HTML injection via allowed iframe
- discourse
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Discourse: Encode action_code_who in mention URLs
- discourse
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
Discourse: Chat upload filenames rendered as raw HTML in excerpts
- discourse
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Discourse: Stored HTML injection in video notification emails
- discourse
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Discourse: Wildcard iframe origin allowlist bypass via authority separators
- discourse
- CWE-346
- CVSS 8.7 High
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- discourse
- Cross-site scripting (XSS)
- CVSS 7.2 High
Discourse: Reject literal backslash path separators in iframe src traversal guard
- discourse
- Path traversal
- CVSS 6.5 Medium
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
- discourse
- Other injection
- CVSS 5.4 Medium
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
- discourse
- CWE-20
- CVSS 4.2 Medium
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
- discourse
- Broken access control
- CVSS 5.4 Medium
Discourse: Stored XSS via unescaped actor name in post actions
- discourse
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
- discourse
- Broken access control
- CVSS 4.3 Medium
Discourse: Shared-draft titles and excerpts leak through group post serialization
- discourse
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Discourse: Cache poisoning/XSS via color scheme cookies
- discourse
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Discourse: Review queue exposes flag-related private message excerpts to category group moderators
- discourse
- Broken access control
- CVSS 4.3 Medium
Discourse: Templates endpoint exposes hidden tag names
- discourse
- Broken access control
- CVSS 7.1 High
Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
- discourse
- SQL injection
- CVSS 8.7 High
Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
- discourse
- Cross-site scripting (XSS)
- CVSS 2.0 Low
Discourse: Stored XSS in discourse-local-dates plugin
- discourse
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Discourse: Onebox iframe origin allowlist enforces URL authority boundary
- discourse
- CWE-20
- CVSS 4.8 Medium
Discourse: Stored XSS in the moderation review queue
- discourse
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Discourse: Unauthorized eavesdropping on private AI bot conversations.
- discourse
- Information disclosure
- CVSS 5.4 Medium
Discourse: Stored XSS in staff action logs injects staff UI
- discourse
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
- discourse
- Broken access control
- CVSS 5.3 Medium
Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
- discourse
- Broken access control
- CVSS 4.3 Medium
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
- discourse
- Broken access control
- CVSS 5.3 Medium
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
- discourse
- CWE-178
- CVSS 6.4 Medium
Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
- discourse
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Discourse: Private event sample invitees are serialized to non-invited event viewers
- discourse
- Information disclosure
- CVSS 7.3 High
Discourse: Stored-XSS in 2FA delete confirmation modal
- discourse
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Discourse: Hidden post revisions leak through adjacent visible diffs
- discourse
- Information disclosure
- CVSS 8.2 High
Discourse: Signup-time primary_group_id assignment grants whisperer access
- discourse
- Privilege escalation
- CVSS 5.4 Medium
Discourse: Insufficient SVG sanitization logic
- discourse
- Cross-site scripting (XSS)
- CVSS 7.4 High
Discourse: Topic featured link susceptible to stored XSS
- discourse
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Discourse: Secure uploads exposed by hotlinked image copying
- discourse
- Information disclosure
- CVSS 6.3 Medium
Discourse: Hidden tag names leaked via category serializers
- discourse
- Information disclosure
- CVSS 6.5 Medium
Discourse: Regular users can route multipart uploads into the admin backup store
- discourse
- Broken access control
- CVSS 6.5 Medium
Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
- discourse
- CWE-345
- CVSS 7.5 High
Discourse: Remote code execution via pdf uploads
- discourse
- Command injection
- CVSS 5.3 Medium
Discourse: Don't leak restricted tag group names via tag info
- discourse
- Information disclosure
- CVSS 4.3 Medium
Discourse: Prevent webhook payload disclosure on event redelivery
- discourse
- Information disclosure
- CVSS 6.8 Medium
Discourse: Cross-site backup access via path traversal in multisite local backups
- discourse
- Path traversal
- CVSS 5.3 Medium
Discourse: Chat misauthorization and information disclosure
- discourse
- Information disclosure
- Broken access control
- CVSS 4.3 Medium
Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
- discourse
- Information disclosure
- CVSS 6.5 Medium
Discourse: Non-staff group owners can see email password in plaintext through group history
- discourse
- Information disclosure
- CVSS 5.4 Medium
Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts
- discourse
- Broken access control
- CVSS 4.3 Medium
Discourse: GroupPostSerializer leaks hidden full names through reaction post association
- discourse
- Information disclosure
- CVSS 4.3 Medium
Discourse: Category queue reviewers can read raw incoming emails from queued posts
- discourse
- Information disclosure
- CVSS 4.3 Medium
Discourse: Bot debug endpoints disclose whisper translation audit logs
- discourse
- Information disclosure
- CVSS 7.5 High
Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users
- discourse
- Information disclosure
- CVSS 2.1 Low
Discourse has a subscription access bypass in its discourse-subscriptions plugin
- discourse
- Broken access control
- CVSS 6.0 Medium
Discourse: Information Disclosure in Form Template API Due to Missing Authorization
- discourse
- Broken access control
- CVSS 5.3 Medium
Discourse: Cached outdated summaries can leak removed content
- discourse
- Information disclosure
- CWE-524
- CVSS 2.7 Low
Discourse: Staged user custom fields are exposed on public invite pages
- discourse
- Information disclosure
- CVSS 6.3 Medium
Discourse: Hidden tag visibility bypass on tag routes
- discourse
- Information disclosure
- CVSS 5.1 Medium
Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure
- discourse
- Broken access control
- CVSS 5.3 Medium
Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
- discourse
- Information disclosure