Discourse

Discourse

252 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2026-27570

  • EPSS 0.35%
  • Veröffentlicht 19.03.2026 20:52:17
  • Zuletzt bearbeitet 25.03.2026 00:59:29

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the SharedAiConversation model renders the conversation title directly into HTML without proper sanitization. Versions ...

4.3

CVE-2026-27491

  • EPSS 0.33%
  • Veröffentlicht 19.03.2026 20:47:54
  • Zuletzt bearbeitet 25.03.2026 01:00:41

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only mod...

5.3

CVE-2026-27454

  • EPSS 0.39%
  • Veröffentlicht 19.03.2026 20:39:28
  • Zuletzt bearbeitet 25.03.2026 01:01:56

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The display_post method called post.revert_to directly...

5.4

CVE-2026-27166

  • EPSS 0.19%
  • Veröffentlicht 19.03.2026 20:29:22
  • Zuletzt bearbeitet 25.03.2026 01:06:00

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page....

2.7

CVE-2026-28227

  • EPSS 3.12%
  • Veröffentlicht 26.02.2026 21:27:38
  • Zuletzt bearbeitet 02.03.2026 18:11:29

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12....

4.3

CVE-2026-28219

  • EPSS 0.2%
  • Veröffentlicht 26.02.2026 21:25:36
  • Zuletzt bearbeitet 02.03.2026 18:12:13

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipul...

5.4

CVE-2026-28218

  • EPSS 0.15%
  • Veröffentlicht 26.02.2026 21:23:32
  • Zuletzt bearbeitet 02.03.2026 18:12:49

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, inclu...

6.1

CVE-2026-27154

  • EPSS 0.17%
  • Veröffentlicht 26.02.2026 21:20:25
  • Zuletzt bearbeitet 02.03.2026 18:13:16

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` ...

2.7

CVE-2026-27153

  • EPSS 0.16%
  • Veröffentlicht 26.02.2026 21:16:41
  • Zuletzt bearbeitet 02.03.2026 18:07:51

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export endpoint by exploiting an overly permissive allowlist in `can_export_entity?`. The method a...

3.8

CVE-2026-27152

  • EPSS 0.16%
  • Veröffentlicht 26.02.2026 20:00:33
  • Zuletzt bearbeitet 02.03.2026 18:03:28

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat::AddUsersToChannel` — a user could add targets who have blocked/ignored/muted them ...