Discourse

Discourse

280 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
3.8

CVE-2026-27150

  • EPSS 0.15%
  • Veröffentlicht 26.02.2026 19:55:35
  • Zuletzt bearbeitet 02.03.2026 18:22:27

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query g...

6.5

CVE-2026-27149

  • EPSS 0.23%
  • Veröffentlicht 26.02.2026 19:52:54
  • Zuletzt bearbeitet 02.03.2026 18:14:00

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private ...

5.3

CVE-2026-27021

  • EPSS 0.28%
  • Veröffentlicht 26.02.2026 19:50:56
  • Zuletzt bearbeitet 02.03.2026 21:31:27

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versi...

2.7

CVE-2026-26979

  • EPSS 0.17%
  • Veröffentlicht 26.02.2026 19:25:15
  • Zuletzt bearbeitet 02.03.2026 21:34:00

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patc...

4.3

CVE-2026-26973

  • EPSS 0.15%
  • Veröffentlicht 26.02.2026 19:19:18
  • Zuletzt bearbeitet 02.03.2026 21:36:35

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging ...

7.5

CVE-2026-26265

  • EPSS 0.27%
  • Veröffentlicht 26.02.2026 15:10:25
  • Zuletzt bearbeitet 02.03.2026 21:37:36

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all user...

5.4

CVE-2026-26207

  • EPSS 0.15%
  • Veröffentlicht 26.02.2026 15:04:14
  • Zuletzt bearbeitet 02.03.2026 21:51:04

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyControlle...

7.5

CVE-2026-26078

  • EPSS 0.22%
  • Veröffentlicht 26.02.2026 15:00:47
  • Zuletzt bearbeitet 02.03.2026 21:52:09

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty strin...

6.5

CVE-2026-26077

  • EPSS 0.24%
  • Veröffentlicht 26.02.2026 14:58:13
  • Zuletzt bearbeitet 02.03.2026 21:53:56

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentic...

6.5

CVE-2026-24742

  • EPSS 0.26%
  • Veröffentlicht 28.01.2026 20:11:30
  • Zuletzt bearbeitet 30.01.2026 20:31:42

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed in...