Discourse discourse

• CVE-2026-44779 Medium 4.3 Discourse: Bot debug endpoints disclose whisper translation audit logs 0.2%
• CVE-2026-44786 High 7.5 Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users 0.3%
• CVE-2026-34154 Low 2.1 Discourse has a subscription access bypass in its discourse-subscriptions plugin 0.2%
• CVE-2026-33514 Medium 6.0 Discourse: Information Disclosure in Form Template API Due to Missing Authorization 0.2%
• CVE-2026-32244 Medium 5.3 Discourse: Cached outdated summaries can leak removed content 0.2%
• CVE-2026-34947 Low 2.7 Discourse: Staged user custom fields are exposed on public invite pages 0.2%
• CVE-2026-27481 Medium 6.3 Discourse: Hidden tag visibility bypass on tag routes 0.2%
• CVE-2026-33415 Medium 4.3 Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure 0.2%
• CVE-2026-33300 Medium 5.3 Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint 0.2%
• CVE-2026-33185 Medium 5.3 Discourse: Group SMTP test endpoint susceptible to SSRF 0.2%
• CVE-2026-33074 Medium 6.3 Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions 0.2%
• CVE-2026-32951 Medium 4.3 Discourse: Authorization bypass in oneboxer via user-controlled category id 0.2%
• CVE-2026-32620 Medium 5.3 Discourse: Missing post-level authorization allows whisper metadata disclosure 0.2%
• CVE-2026-32619 Medium 6.3 Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories 0.2%
• CVE-2026-32618 Medium 4.3 Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id 0.2%
• CVE-2026-32615 Medium 5.3 Discourse: Category group moderators can perform actions on topics in restricted categories without read access 0.2%
• CVE-2026-32607 Low 2.1 Discourse: Stored XSS via unescaped assignee name 0.2%
• CVE-2026-32273 Medium 5.4 Discourse: XSS on category description update via API 0.2%
• CVE-2026-32243 Medium 6.1 Discourse: Stored XSS in discourse-ai shared conversations onebox 0.2%
• CVE-2026-32113 Medium 5.1 Discourse: Open redirect via `sso_destination_url` cookie in `enter` 0.2%
• CVE-2026-32143 Medium 5.3 Discourse: Admin-only report can be exported by moderators 0.2%
• CVE-2026-33073 Medium 5.3 discourse-subscriptions plugin leaking stripe API key in multisite environment 0.2%
• CVE-2026-33428 Medium 4.9 Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership 0.3%
• CVE-2026-33427 Low 2.7 Discourse Authorization Page Displays Unvalidated Redirect Domain 0.2%
• CVE-2026-33426 Low 3.5 Discourse users can edit or synonymize hidden tags they can't see 0.2%
• CVE-2026-33425 Medium 6.9 Discourse has inferable private group membership or existence via exclude_groups parameter 0.7%
• CVE-2026-33424 Medium 5.9 PM access granted through invites after access revocation 0.2%
• CVE-2026-33423 Low 1.3 Discourse staff can modify any user's group notification level 0.2%
• CVE-2026-33422 Low 3.5 Discourse exposes ip_address of flagged user 0.3%
• CVE-2026-33411 Medium 5.4 Discourse's solved topic stream has potential stored XSS in topic title 0.2%
• CVE-2026-33291 Medium 5.1 Discourse user can create Zendesk tickets even when it does not have access to topic 0.2%
• CVE-2026-33251 Medium 5.4 Discourse has a Hidden Solved topics permission bypass 0.2%
• CVE-2026-32114 Medium 5.3 Discourse's unscoped status lookups leak restricted metadata 0.2%
• CVE-2026-31869 Medium 5.3 Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check 0.2%
• CVE-2026-31805 Medium 5.3 Discourse has a poll authorization bypass via post_id array parameter 0.2%
• CVE-2026-30891 Medium 5.3 Discourse hasUnauthorized Exposure of Private User Action Types 0.2%
• CVE-2026-30889 Medium 5.3 Discourse has Unauthorized Post Data Exposure in discourse-user-notes 0.3%
• CVE-2026-30888 Low 2.2 Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint 0.2%
• CVE-2026-33408 Low 2.2 Discourse has Improper Authorization in "Post Edits" Report For Moderators 0.3%
• CVE-2026-33395 Medium 4.4 Discourse has stored click‑based XSS via Graphviz SVG javascript: links 0.2%
• CVE-2026-33394 Low 2.7 Discourse leaks PM post edits to moderators 0.4%
• CVE-2026-33393 Medium 4.3 Discourse fixes loose hostname matching in spam host allowlist 0.3%
• CVE-2026-33355 Medium 6.5 Discourse filters whisper posts from private-posts feed 0.4%
• CVE-2026-33410 Medium 5.4 Discourse hardens chat DM channel creation and expansion 0.2%
• CVE-2026-32099 Medium 4.3 Discourse prevents hidden profile data leak via user onebox 0.3%
• CVE-2026-29072 High 8.2 Discourse missing permission check for policy creation in discourse-policy 0.2%
• CVE-2026-28282 Low 2.3 Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin 0.4%
• CVE-2026-27936 Medium 6.9 Discourse discloses restricted post-action counts to non-privileged users 0.3%
• CVE-2026-27935 Medium 6.9 Discourse leaks private topic metadata to non-authorized users 0.3%
• CVE-2026-27934 High 8.7 Discourse leaks private topic title and post excerpt via user action API endpoint 1.2%