By vendor

Discourse vulnerabilities

Known CVEs affecting Discourse products, prioritized by severity, with SEC.co remediation and detection guidance.

22 published vulnerabilities

• CVE-2026-44787HIGH 8.2

  A vulnerability in Discourse's user registration process allows newly created accounts to bypass group membership restrictions and gain unauthorized access to whisper groups—a feature used to restrict message visibility to group members. An attacker can exploit this during signup by manually setting a group ID parameter, gaining the same message-filtering privileges as legitimate group members without any approval or validation. This affects Discourse instances that have the whispers_allowed_groups feature configured.

• CVE-2026-44786HIGH 7.5

  Discourse, a popular open-source discussion platform, has a flaw in how it handles chat messages for public categories. When users post in public category chat channels, the system broadcasts those messages through MessageBus—a real-time messaging system—without properly checking who should be allowed to see them. This means anyone subscribed to MessageBus, even if they don't have chat functionality enabled, could receive and read private chat message content they shouldn't have access to. The issue affects Discourse versions released from early 2026 through mid-2026, but patches are now available.

• CVE-2026-45788HIGH 7.5

  Discourse, a popular open-source discussion and community platform, contains a vulnerability in its secure uploads feature that could allow unauthorized access to sensitive files. When the secure_uploads setting is enabled—which is meant to protect uploaded content from public viewing—an attacker who discovers the hidden URL of a secured upload can retrieve it through Discourse's pull_hotlinked_images function, bypassing access controls. This is a confidentiality issue affecting instances running older versions of Discourse.

• CVE-2026-49256HIGH 7.5

  Discourse, a popular open-source discussion platform, was leaking sensitive metadata to unauthorized users. Specifically, restricted tag and tag-group names that should have been hidden were becoming visible to anonymous visitors and users without proper permissions when viewing publicly readable categories. This information disclosure occurred through the category and group API endpoints. Four patch versions address this issue across the supported release branches.

• CVE-2026-55420HIGH 7.5

  Discourse, a popular open-source discussion platform, contains a vulnerability in how it processes PDF file uploads under certain non-default server configurations. An authenticated user could exploit this flaw to execute arbitrary code on the server hosting Discourse. The vulnerability affects multiple version branches and has been patched in recent releases across the supported version lines.

• CVE-2026-53963HIGH 7.3

  A flaw in Discourse allows an attacker with an account on the platform to inject malicious code into a second factor (like a 2FA security key) display name. When a site administrator impersonates that attacker's account for troubleshooting or support purposes, the unescaped name executes in the admin's browser, potentially letting the attacker steal the admin's session, modify forum content, or perform other harmful actions. The issue stems from insufficient sanitization in the account deletion confirmation dialog.

• CVE-2026-45775MEDIUM 6.8

  Discourse, a popular open-source discussion platform, contains a path traversal vulnerability in its backup handling system that could allow an authenticated site administrator to access backup files from other sites within the same multisite deployment. The vulnerability affects versions 2026.1.0 through 2026.1.3, 2026.3.0, and 2026.4.0. An attacker with admin privileges on one Discourse site could craft a specially crafted backup download request to retrieve sensitive backup data from a different site hosted on the same infrastructure. This requires existing administrative authentication and only impacts deployments where backups are stored locally on the same server. The issue has been resolved in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

• CVE-2026-44784MEDIUM 6.5

  Discourse group owners can view their group's SMTP credentials in plaintext through the group history log, even if they lack admin or moderator privileges. This vulnerability allows unauthorized credential exposure—particularly the SMTP password—which could be misused to send emails impersonating the group from outside Discourse. The issue affects Discourse installations running vulnerable versions that have configured per-group SMTP settings and assigned group ownership to users who should not have access to email infrastructure credentials.

• CVE-2026-46413MEDIUM 6.5

  Discourse, a widely-used open-source discussion platform, contains a vulnerability that allows regular (non-admin) users to upload files to sensitive backup storage areas that should be restricted to administrators only. An authenticated user can exploit S3 multipart upload functionality to bypass access controls and write files into the admin backup store. This is a privilege-escalation issue affecting data integrity rather than confidentiality; the vulnerability requires an existing user account but does not require special permissions to trigger.

• CVE-2026-53961MEDIUM 6.5

  Discourse instances running before specific patched versions are vulnerable to a webhook validation bypass affecting AWS Simple Email Service (SES) integration. An attacker with any AWS account can send forged bounce notifications to a target Discourse instance, causing legitimate user email addresses to be revoked from the platform. The flaw stems from incomplete validation of AWS SNS messages—while Discourse verified the cryptographic signature, it failed to confirm that bounce notifications came from the expected AWS topic, leaving the door open for spoofing.

• CVE-2026-44783MEDIUM 5.4

  Discourse, a popular open-source discussion platform, contains a flaw in how it handles replies to whisper posts. The vulnerability allows authenticated users who are not members of groups configured to access whispers to inject messages into staff-only whisper channels. This means someone with a regular user account could post messages that appear alongside legitimate staff whispers, potentially disrupting internal conversations or spreading misinformation among staff members. The vulnerability affects versions released between early 2026 and April 2026, and has been patched in all active release branches.

• CVE-2026-53962MEDIUM 5.4

  Discourse, a popular open-source discussion platform, has a vulnerability in how it sanitizes uploaded SVG files and user avatars. An attacker with a user account could craft a malicious SVG that executes JavaScript in the browser when specific non-standard URLs are accessed. This requires user interaction (clicking a link) and only affects visitors to those particular URLs, not the general community experience. The vulnerability has been patched in recent versions across multiple release branches.

• CVE-2026-55424MEDIUM 5.4

  Discourse forums can be vulnerable to JavaScript injection through topic featured links. If a user with permission to set a featured link on a topic crafts a malicious link, it could execute arbitrary JavaScript in other users' browsers when they view the topic list—but only if the site administrator has modified or disabled Discourse's default Content Security Policy. This is a stored cross-site scripting (XSS) vulnerability that affects multiple Discourse release branches.

• CVE-2026-45085MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains four separate authorization and information disclosure flaws in its chat plugin (and one overlapping with the calendar plugin). The vulnerabilities allow read-only category members to create chat threads they shouldn't, permit users to recover deleted messages even after losing channel access, expose unrelated private messages to moderators reviewing flagged content, and leak chat channel details and message content to unauthorized viewers including anonymous users. These gaps bypass intended access controls and leak sensitive conversation data. The issues affect Discourse instances with the chat plugin enabled; the calendar-related exposure additionally requires the discourse-calendar plugin.

• CVE-2026-45780MEDIUM 5.3

  Discourse, an open-source discussion platform, has a flaw in how it handles event information that could unintentionally reveal sensitive details about private events. Specifically, the names of invited groups, sample invitee lists, and attendance statistics were being exposed to anyone who could view a topic—even if they shouldn't have access to the private event's invitee information. This is a permissions boundary issue: unauthorized users gain visibility into data they're not entitled to see. The vendor has patched this across multiple supported versions.

• CVE-2026-47264MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains an information disclosure vulnerability that exposes the names of restricted tag groups to unauthorized users. When the site setting 'tags_listed_by_group' is enabled, anonymous and unprivileged users can access an endpoint that reveals tag group names—including those meant to be invisible or restricted to specific user groups. This occurs because the system failed to filter sensitive metadata based on the requesting user's actual permissions. The vulnerability affects multiple version branches and has been patched across all active release tracks.

• CVE-2026-59828MEDIUM 5.3

  Discourse, an open-source discussion platform, contains a vulnerability that allows post revision history to leak information that should remain hidden from regular users. When users view adjacent post revisions, the serialization process can expose diffs that include content from hidden revisions. This affects instances running Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5. The leak occurs through normal diff display functionality rather than requiring special privileges, though the impact is limited to information disclosure.

• CVE-2026-44779MEDIUM 4.3

  Discourse, a popular open-source discussion platform, contains a flaw in bot debug endpoints that unintentionally exposes sensitive whisper translation audit logs. Whispers are private messages intended only for specific users or moderators, and their translation records should not be accessible. Authenticated users can access these debug endpoints and retrieve information about whisper translations that they shouldn't see, potentially revealing private conversations and moderation activities. The vulnerability affects multiple active release branches and has been patched.

• CVE-2026-44780MEDIUM 4.3

  Discourse has a privilege-bypass vulnerability where category moderators can read the full source of emails submitted to the platform, even if they lack explicit permission to view raw email content. When posts arrive via incoming email integration, a serialization component unintentionally exposes complete email headers, metadata, and body to anyone reviewing flagged posts—sidestepping the normal access controls that restrict raw email viewing. This leaks potentially sensitive information embedded in inbound emails to a wider set of moderators than intended.

• CVE-2026-44782MEDIUM 4.3

  Discourse, an open-source discussion platform, contains a logic error in how it handles user name visibility settings. Due to a misnamed predicate in the GroupPostSerializer component, user names are always included in API responses regardless of the site administrator's configuration to disable them. An authenticated user can exploit this to retrieve user name information that should be hidden, even when the 'enable_names' setting is turned off. The issue affects multiple version branches and has been patched.

• CVE-2026-44785MEDIUM 4.3

  Discourse, an open-source discussion platform, contains an authorization flaw in its AI-powered "explain" feature. When a user asks the system to explain a reply to a post, the feature only checks whether the user can see the reply itself—not whether they should have access to the parent post being discussed. This oversight allows any authenticated user with access to the AI helper to read hidden or restricted parent posts by simply requesting an explanation of a public reply to them. The vulnerability affects multiple version branches and has been patched.

• CVE-2026-47263MEDIUM 4.3

  Discourse versions released between early 2026 and mid-2026 contain an access control flaw in their webhook event redelivery system. When Discourse attempts to resend failed webhook notifications, it broadcasts internal event data to a world-readable channel without properly restricting who can see it. Any logged-in user—or any visitor on instances without login requirements—can discover and read webhook events by guessing sequential webhook IDs. This exposes sensitive data that webhook endpoints are designed to receive privately, such as user activity, content moderation events, or custom application logic tied to your Discourse instance.