By vendor
Discourse vulnerabilities
Known CVEs affecting Discourse products, prioritized by severity, with SEC.co remediation and detection guidance.
10 published vulnerabilities
- CVE-2026-44786HIGH 7.5
Discourse, a popular open-source discussion platform, has a flaw in how it handles chat messages for public categories. When users post in public category chat channels, the system broadcasts those messages through MessageBus—a real-time messaging system—without properly checking who should be allowed to see them. This means anyone subscribed to MessageBus, even if they don't have chat functionality enabled, could receive and read private chat message content they shouldn't have access to. The issue affects Discourse versions released from early 2026 through mid-2026, but patches are now available.
- CVE-2026-45775MEDIUM 6.8
Discourse, a popular open-source discussion platform, contains a path traversal vulnerability in its backup handling system that could allow an authenticated site administrator to access backup files from other sites within the same multisite deployment. The vulnerability affects versions 2026.1.0 through 2026.1.3, 2026.3.0, and 2026.4.0. An attacker with admin privileges on one Discourse site could craft a specially crafted backup download request to retrieve sensitive backup data from a different site hosted on the same infrastructure. This requires existing administrative authentication and only impacts deployments where backups are stored locally on the same server. The issue has been resolved in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
- CVE-2026-44784MEDIUM 6.5
Discourse group owners can view their group's SMTP credentials in plaintext through the group history log, even if they lack admin or moderator privileges. This vulnerability allows unauthorized credential exposure—particularly the SMTP password—which could be misused to send emails impersonating the group from outside Discourse. The issue affects Discourse installations running vulnerable versions that have configured per-group SMTP settings and assigned group ownership to users who should not have access to email infrastructure credentials.
- CVE-2026-44783MEDIUM 5.4
Discourse, a popular open-source discussion platform, contains a flaw in how it handles replies to whisper posts. The vulnerability allows authenticated users who are not members of groups configured to access whispers to inject messages into staff-only whisper channels. This means someone with a regular user account could post messages that appear alongside legitimate staff whispers, potentially disrupting internal conversations or spreading misinformation among staff members. The vulnerability affects versions released between early 2026 and April 2026, and has been patched in all active release branches.
- CVE-2026-47264MEDIUM 5.3
Discourse, a popular open-source discussion platform, contains an information disclosure vulnerability that exposes the names of restricted tag groups to unauthorized users. When the site setting 'tags_listed_by_group' is enabled, anonymous and unprivileged users can access an endpoint that reveals tag group names—including those meant to be invisible or restricted to specific user groups. This occurs because the system failed to filter sensitive metadata based on the requesting user's actual permissions. The vulnerability affects multiple version branches and has been patched across all active release tracks.
- CVE-2026-44779MEDIUM 4.3
Discourse, a popular open-source discussion platform, contains a flaw in bot debug endpoints that unintentionally exposes sensitive whisper translation audit logs. Whispers are private messages intended only for specific users or moderators, and their translation records should not be accessible. Authenticated users can access these debug endpoints and retrieve information about whisper translations that they shouldn't see, potentially revealing private conversations and moderation activities. The vulnerability affects multiple active release branches and has been patched.
- CVE-2026-44780MEDIUM 4.3
Discourse has a privilege-bypass vulnerability where category moderators can read the full source of emails submitted to the platform, even if they lack explicit permission to view raw email content. When posts arrive via incoming email integration, a serialization component unintentionally exposes complete email headers, metadata, and body to anyone reviewing flagged posts—sidestepping the normal access controls that restrict raw email viewing. This leaks potentially sensitive information embedded in inbound emails to a wider set of moderators than intended.
- CVE-2026-44782MEDIUM 4.3
Discourse, an open-source discussion platform, contains a logic error in how it handles user name visibility settings. Due to a misnamed predicate in the GroupPostSerializer component, user names are always included in API responses regardless of the site administrator's configuration to disable them. An authenticated user can exploit this to retrieve user name information that should be hidden, even when the 'enable_names' setting is turned off. The issue affects multiple version branches and has been patched.
- CVE-2026-44785MEDIUM 4.3
Discourse, an open-source discussion platform, contains an authorization flaw in its AI-powered "explain" feature. When a user asks the system to explain a reply to a post, the feature only checks whether the user can see the reply itself—not whether they should have access to the parent post being discussed. This oversight allows any authenticated user with access to the AI helper to read hidden or restricted parent posts by simply requesting an explanation of a public reply to them. The vulnerability affects multiple version branches and has been patched.
- CVE-2026-47263MEDIUM 4.3
Discourse versions released between early 2026 and mid-2026 contain an access control flaw in their webhook event redelivery system. When Discourse attempts to resend failed webhook notifications, it broadcasts internal event data to a world-readable channel without properly restricting who can see it. Any logged-in user—or any visitor on instances without login requirements—can discover and read webhook events by guessing sequential webhook IDs. This exposes sensitive data that webhook endpoints are designed to receive privately, such as user activity, content moderation events, or custom application logic tied to your Discourse instance.