Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
646 vulnerabilities by Discourse
CVE-2026-91121 (GCVE-0-2026-91121)
Vulnerability from nvd – Published: 2026-09-24 17:05 – Updated: 2026-09-24 17:27
VLAI
EPSS
VEX
Title
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:27 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/24c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6e7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/9d6… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/af1… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:27:35.450393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:27:43.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:05:20.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278"
},
{
"name": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787"
},
{
"name": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b"
},
{
"name": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"
}
],
"source": {
"advisory": "GHSA-34rh-wjfv-65gq",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat upload filenames rendered as raw HTML in excerpts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91121",
"datePublished": "2026-09-24T17:05:20.530Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:27:43.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91120 (GCVE-0-2026-91120)
Vulnerability from nvd – Published: 2026-09-24 17:00 – Updated: 2026-09-24 17:24
VLAI
EPSS
VEX
Title
Discourse: Stored HTML injection in video notification emails
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6bf… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/833… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e7d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ed8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:24:51.329319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:24:59.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:00:05.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f"
},
{
"name": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3"
},
{
"name": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76"
},
{
"name": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"
}
],
"source": {
"advisory": "GHSA-h7cg-2vww-m45c",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored HTML injection in video notification emails"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91120",
"datePublished": "2026-09-24T17:00:05.331Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:24:59.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91119 (GCVE-0-2026-91119)
Vulnerability from nvd – Published: 2026-09-24 17:07 – Updated: 2026-09-28 15:00
VLAI
EPSS
VEX
Title
Discourse: Encode action_code_who in mention URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 14:59 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/666… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/77a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c47… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T14:59:51.871193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:00:02.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:07:04.367Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c"
},
{
"name": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035"
},
{
"name": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a"
},
{
"name": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"
}
],
"source": {
"advisory": "GHSA-pv3p-p3m9-v8v3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Encode action_code_who in mention URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91119",
"datePublished": "2026-09-24T17:07:04.367Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-28T15:00:02.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91134 (GCVE-0-2026-91134)
Vulnerability from nvd – Published: 2026-09-24 16:51 – Updated: 2026-09-29 02:56
VLAI
EPSS
VEX
Title
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:56 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0a8… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/130… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/bac… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/fed… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:56:20.350456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:56:30.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:51:34.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415"
},
{
"name": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590"
},
{
"name": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d"
},
{
"name": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"
}
],
"source": {
"advisory": "GHSA-54vw-chv3-wjpv",
"discovery": "UNKNOWN"
},
"title": "Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91134",
"datePublished": "2026-09-24T16:51:34.057Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:56:30.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91133 (GCVE-0-2026-91133)
Vulnerability from nvd – Published: 2026-09-24 16:53 – Updated: 2026-09-24 17:12
VLAI
EPSS
VEX
Title
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:12 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/113… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a04… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cb3… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:12:40.098136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:12:50.099Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:53:00.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52"
},
{
"name": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f"
},
{
"name": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd"
},
{
"name": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"
}
],
"source": {
"advisory": "GHSA-8hxh-573g-52gx",
"discovery": "UNKNOWN"
},
"title": "Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91133",
"datePublished": "2026-09-24T16:53:00.147Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-24T17:12:50.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91132 (GCVE-0-2026-91132)
Vulnerability from nvd – Published: 2026-09-24 16:57 – Updated: 2026-09-29 02:57
VLAI
EPSS
VEX
Title
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:57 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/809… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d5a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d88… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/db8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:57:23.434341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:57:34.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:57:43.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5"
},
{
"name": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a"
},
{
"name": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9"
},
{
"name": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"
}
],
"source": {
"advisory": "GHSA-4q3q-hph3-3rvp",
"discovery": "UNKNOWN"
},
"title": "Discourse: Wildcard iframe origin allowlist bypass via authority separators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91132",
"datePublished": "2026-09-24T16:57:43.082Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:57:34.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91123 (GCVE-0-2026-91123)
Vulnerability from nvd – Published: 2026-09-24 16:54 – Updated: 2026-09-24 17:11
VLAI
EPSS
VEX
Title
Discourse: Reject literal backslash path separators in iframe src traversal guard
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:11 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/042… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/097… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0b5… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/142… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:11:25.606443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:11:34.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:54:59.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318"
},
{
"name": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24"
},
{
"name": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be"
},
{
"name": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"
}
],
"source": {
"advisory": "GHSA-6pwj-wgg8-4rjc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Reject literal backslash path separators in iframe src traversal guard"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91123",
"datePublished": "2026-09-24T16:54:59.357Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:11:34.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91122 (GCVE-0-2026-91122)
Vulnerability from nvd – Published: 2026-09-24 16:56 – Updated: 2026-09-24 17:25
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/05d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/567… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c39… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d71… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:25:16.666454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:25:54.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer\u0027s session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:56:26.568Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d"
},
{
"name": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031"
},
{
"name": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda"
},
{
"name": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"
}
],
"source": {
"advisory": "GHSA-8m44-f6g9-7cg7",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91122",
"datePublished": "2026-09-24T16:56:26.568Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:25:54.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84302 (GCVE-0-2026-84302)
Vulnerability from nvd – Published: 2026-09-24 16:49 – Updated: 2026-09-24 17:04
VLAI
EPSS
VEX
Title
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:04 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/156… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/234… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/38d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b32… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:04:31.550424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:04:51.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:49:56.499Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427"
},
{
"name": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5"
},
{
"name": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd"
},
{
"name": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"
}
],
"source": {
"advisory": "GHSA-3rx9-fqgh-wfpc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84302",
"datePublished": "2026-09-24T16:49:56.499Z",
"dateReserved": "2026-09-01T16:17:43.078Z",
"dateUpdated": "2026-09-24T17:04:51.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59830 (GCVE-0-2026-59830)
Vulnerability from nvd – Published: 2026-09-21 21:17 – Updated: 2026-09-22 15:38
VLAI
EPSS
VEX
Title
Discourse: Stored XSS via unescaped actor name in post actions
Summary
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 14:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/dd7… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T14:12:11.883033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:38:41.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user\u0027s browser. This issue is fixed in version 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T21:17:38.733Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw"
},
{
"name": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.7.0"
}
],
"source": {
"advisory": "GHSA-x6mf-p7cg-69rw",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS via unescaped actor name in post actions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59830",
"datePublished": "2026-09-21T21:17:38.733Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-09-22T15:38:41.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59829 (GCVE-0-2026-59829)
Vulnerability from nvd – Published: 2026-08-17 15:26 – Updated: 2026-08-17 19:00
VLAI
EPSS
VEX
Title
Discourse: Review queue exposes flag-related private message excerpts to category group moderators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 19:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/41527 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/4df… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/58e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/74c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e56… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T19:00:39.979003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T19:00:49.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category\u0027s moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator\u0027s group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:26:53.835Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w"
},
{
"name": "https://github.com/discourse/discourse/pull/41527",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/41527"
},
{
"name": "https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59"
},
{
"name": "https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754"
},
{
"name": "https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa"
},
{
"name": "https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9"
}
],
"source": {
"advisory": "GHSA-wmc6-pmxp-xw5w",
"discovery": "UNKNOWN"
},
"title": "Discourse: Review queue exposes flag-related private message excerpts to category group moderators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59829",
"datePublished": "2026-08-17T15:26:53.835Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-08-17T19:00:49.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55704 (GCVE-0-2026-55704)
Vulnerability from nvd – Published: 2026-08-17 15:31 – Updated: 2026-08-17 22:02
VLAI
EPSS
VEX
Title
Discourse: Shared-draft titles and excerpts leak through group post serialization
Summary
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 21:29 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T21:29:14.994826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T22:02:06.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group\u2019s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:31:41.130Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8"
}
],
"source": {
"advisory": "GHSA-fxw4-38v9-76v8",
"discovery": "UNKNOWN"
},
"title": "Discourse: Shared-draft titles and excerpts leak through group post serialization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55704",
"datePublished": "2026-08-17T15:31:41.130Z",
"dateReserved": "2026-06-17T00:13:10.651Z",
"dateUpdated": "2026-08-17T22:02:06.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55674 (GCVE-0-2026-55674)
Vulnerability from nvd – Published: 2026-08-17 15:30 – Updated: 2026-08-18 14:43
VLAI
EPSS
VEX
Title
Discourse: Cache poisoning/XSS via color scheme cookies
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:42:55.146337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:43:21.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse\u0027s nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors\u0027 browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:30:17.691Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-qx4v-rg4v-pm2g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-qx4v-rg4v-pm2g"
}
],
"source": {
"advisory": "GHSA-qx4v-rg4v-pm2g",
"discovery": "UNKNOWN"
},
"title": "Discourse: Cache poisoning/XSS via color scheme cookies"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55674",
"datePublished": "2026-08-17T15:30:17.691Z",
"dateReserved": "2026-06-17T00:05:03.778Z",
"dateUpdated": "2026-08-18T14:43:21.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53960 (GCVE-0-2026-53960)
Vulnerability from nvd – Published: 2026-08-17 15:33 – Updated: 2026-08-17 15:48
VLAI
EPSS
VEX
Title
Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:47:57.954658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:48:08.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:33:14.312Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-j5j7-w5g3-43q8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-j5j7-w5g3-43q8"
}
],
"source": {
"advisory": "GHSA-j5j7-w5g3-43q8",
"discovery": "UNKNOWN"
},
"title": "Discourse: Hidden first-post excerpt is emitted in Q\u0026A schema JSON-LD"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53960",
"datePublished": "2026-08-17T15:33:14.312Z",
"dateReserved": "2026-06-11T15:50:01.282Z",
"dateUpdated": "2026-08-17T15:48:08.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72732 (GCVE-0-2026-72732)
Vulnerability from nvd – Published: 2026-08-10 17:18 – Updated: 2026-08-13 17:37
VLAI
EPSS
VEX
Title
Discourse: Templates endpoint exposes hidden tag names
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:37 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/25e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c9b… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f21… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f41… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T17:37:25.435786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:37:34.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:18:00.524Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm"
},
{
"name": "https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c"
},
{
"name": "https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b"
},
{
"name": "https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0"
},
{
"name": "https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1"
}
],
"source": {
"advisory": "GHSA-xrgc-52m8-82hm",
"discovery": "UNKNOWN"
},
"title": "Discourse: Templates endpoint exposes hidden tag names"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72732",
"datePublished": "2026-08-10T17:18:00.524Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-13T17:37:34.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91119 (GCVE-0-2026-91119)
Vulnerability from cvelistv5 – Published: 2026-09-24 17:07 – Updated: 2026-09-28 15:00
VLAI
EPSS
VEX
Title
Discourse: Encode action_code_who in mention URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 14:59 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/666… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/77a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c47… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T14:59:51.871193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:00:02.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:07:04.367Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c"
},
{
"name": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035"
},
{
"name": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a"
},
{
"name": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"
}
],
"source": {
"advisory": "GHSA-pv3p-p3m9-v8v3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Encode action_code_who in mention URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91119",
"datePublished": "2026-09-24T17:07:04.367Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-28T15:00:02.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91121 (GCVE-0-2026-91121)
Vulnerability from cvelistv5 – Published: 2026-09-24 17:05 – Updated: 2026-09-24 17:27
VLAI
EPSS
VEX
Title
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:27 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/24c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6e7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/9d6… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/af1… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:27:35.450393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:27:43.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:05:20.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278"
},
{
"name": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787"
},
{
"name": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b"
},
{
"name": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"
}
],
"source": {
"advisory": "GHSA-34rh-wjfv-65gq",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat upload filenames rendered as raw HTML in excerpts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91121",
"datePublished": "2026-09-24T17:05:20.530Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:27:43.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91120 (GCVE-0-2026-91120)
Vulnerability from cvelistv5 – Published: 2026-09-24 17:00 – Updated: 2026-09-24 17:24
VLAI
EPSS
VEX
Title
Discourse: Stored HTML injection in video notification emails
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6bf… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/833… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e7d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ed8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:24:51.329319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:24:59.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:00:05.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f"
},
{
"name": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3"
},
{
"name": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76"
},
{
"name": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"
}
],
"source": {
"advisory": "GHSA-h7cg-2vww-m45c",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored HTML injection in video notification emails"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91120",
"datePublished": "2026-09-24T17:00:05.331Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:24:59.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91132 (GCVE-0-2026-91132)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:57 – Updated: 2026-09-29 02:57
VLAI
EPSS
VEX
Title
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:57 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/809… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d5a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d88… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/db8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:57:23.434341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:57:34.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:57:43.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5"
},
{
"name": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a"
},
{
"name": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9"
},
{
"name": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"
}
],
"source": {
"advisory": "GHSA-4q3q-hph3-3rvp",
"discovery": "UNKNOWN"
},
"title": "Discourse: Wildcard iframe origin allowlist bypass via authority separators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91132",
"datePublished": "2026-09-24T16:57:43.082Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:57:34.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91122 (GCVE-0-2026-91122)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:56 – Updated: 2026-09-24 17:25
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/05d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/567… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c39… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d71… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:25:16.666454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:25:54.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer\u0027s session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:56:26.568Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d"
},
{
"name": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031"
},
{
"name": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda"
},
{
"name": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"
}
],
"source": {
"advisory": "GHSA-8m44-f6g9-7cg7",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91122",
"datePublished": "2026-09-24T16:56:26.568Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:25:54.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91123 (GCVE-0-2026-91123)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:54 – Updated: 2026-09-24 17:11
VLAI
EPSS
VEX
Title
Discourse: Reject literal backslash path separators in iframe src traversal guard
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:11 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/042… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/097… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0b5… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/142… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:11:25.606443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:11:34.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:54:59.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318"
},
{
"name": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24"
},
{
"name": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be"
},
{
"name": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"
}
],
"source": {
"advisory": "GHSA-6pwj-wgg8-4rjc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Reject literal backslash path separators in iframe src traversal guard"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91123",
"datePublished": "2026-09-24T16:54:59.357Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:11:34.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91133 (GCVE-0-2026-91133)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:53 – Updated: 2026-09-24 17:12
VLAI
EPSS
VEX
Title
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:12 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/113… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a04… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cb3… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:12:40.098136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:12:50.099Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:53:00.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52"
},
{
"name": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f"
},
{
"name": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd"
},
{
"name": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"
}
],
"source": {
"advisory": "GHSA-8hxh-573g-52gx",
"discovery": "UNKNOWN"
},
"title": "Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91133",
"datePublished": "2026-09-24T16:53:00.147Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-24T17:12:50.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91134 (GCVE-0-2026-91134)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:51 – Updated: 2026-09-29 02:56
VLAI
EPSS
VEX
Title
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:56 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0a8… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/130… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/bac… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/fed… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:56:20.350456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:56:30.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:51:34.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415"
},
{
"name": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590"
},
{
"name": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d"
},
{
"name": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"
}
],
"source": {
"advisory": "GHSA-54vw-chv3-wjpv",
"discovery": "UNKNOWN"
},
"title": "Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91134",
"datePublished": "2026-09-24T16:51:34.057Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:56:30.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84302 (GCVE-0-2026-84302)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:49 – Updated: 2026-09-24 17:04
VLAI
EPSS
VEX
Title
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:04 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/156… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/234… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/38d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b32… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:04:31.550424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:04:51.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:49:56.499Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427"
},
{
"name": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5"
},
{
"name": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd"
},
{
"name": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"
}
],
"source": {
"advisory": "GHSA-3rx9-fqgh-wfpc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84302",
"datePublished": "2026-09-24T16:49:56.499Z",
"dateReserved": "2026-09-01T16:17:43.078Z",
"dateUpdated": "2026-09-24T17:04:51.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59830 (GCVE-0-2026-59830)
Vulnerability from cvelistv5 – Published: 2026-09-21 21:17 – Updated: 2026-09-22 15:38
VLAI
EPSS
VEX
Title
Discourse: Stored XSS via unescaped actor name in post actions
Summary
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 14:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/dd7… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T14:12:11.883033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:38:41.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user\u0027s browser. This issue is fixed in version 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T21:17:38.733Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw"
},
{
"name": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.7.0"
}
],
"source": {
"advisory": "GHSA-x6mf-p7cg-69rw",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS via unescaped actor name in post actions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59830",
"datePublished": "2026-09-21T21:17:38.733Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-09-22T15:38:41.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53960 (GCVE-0-2026-53960)
Vulnerability from cvelistv5 – Published: 2026-08-17 15:33 – Updated: 2026-08-17 15:48
VLAI
EPSS
VEX
Title
Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:47:57.954658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:48:08.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:33:14.312Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-j5j7-w5g3-43q8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-j5j7-w5g3-43q8"
}
],
"source": {
"advisory": "GHSA-j5j7-w5g3-43q8",
"discovery": "UNKNOWN"
},
"title": "Discourse: Hidden first-post excerpt is emitted in Q\u0026A schema JSON-LD"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53960",
"datePublished": "2026-08-17T15:33:14.312Z",
"dateReserved": "2026-06-11T15:50:01.282Z",
"dateUpdated": "2026-08-17T15:48:08.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55704 (GCVE-0-2026-55704)
Vulnerability from cvelistv5 – Published: 2026-08-17 15:31 – Updated: 2026-08-17 22:02
VLAI
EPSS
VEX
Title
Discourse: Shared-draft titles and excerpts leak through group post serialization
Summary
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 21:29 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T21:29:14.994826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T22:02:06.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group\u2019s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:31:41.130Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8"
}
],
"source": {
"advisory": "GHSA-fxw4-38v9-76v8",
"discovery": "UNKNOWN"
},
"title": "Discourse: Shared-draft titles and excerpts leak through group post serialization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55704",
"datePublished": "2026-08-17T15:31:41.130Z",
"dateReserved": "2026-06-17T00:13:10.651Z",
"dateUpdated": "2026-08-17T22:02:06.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55674 (GCVE-0-2026-55674)
Vulnerability from cvelistv5 – Published: 2026-08-17 15:30 – Updated: 2026-08-18 14:43
VLAI
EPSS
VEX
Title
Discourse: Cache poisoning/XSS via color scheme cookies
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:42:55.146337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:43:21.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse\u0027s nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors\u0027 browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:30:17.691Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-qx4v-rg4v-pm2g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-qx4v-rg4v-pm2g"
}
],
"source": {
"advisory": "GHSA-qx4v-rg4v-pm2g",
"discovery": "UNKNOWN"
},
"title": "Discourse: Cache poisoning/XSS via color scheme cookies"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55674",
"datePublished": "2026-08-17T15:30:17.691Z",
"dateReserved": "2026-06-17T00:05:03.778Z",
"dateUpdated": "2026-08-18T14:43:21.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59829 (GCVE-0-2026-59829)
Vulnerability from cvelistv5 – Published: 2026-08-17 15:26 – Updated: 2026-08-17 19:00
VLAI
EPSS
VEX
Title
Discourse: Review queue exposes flag-related private message excerpts to category group moderators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 19:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/41527 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/4df… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/58e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/74c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e56… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T19:00:39.979003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T19:00:49.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category\u0027s moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator\u0027s group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:26:53.835Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w"
},
{
"name": "https://github.com/discourse/discourse/pull/41527",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/41527"
},
{
"name": "https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59"
},
{
"name": "https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754"
},
{
"name": "https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa"
},
{
"name": "https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9"
}
],
"source": {
"advisory": "GHSA-wmc6-pmxp-xw5w",
"discovery": "UNKNOWN"
},
"title": "Discourse: Review queue exposes flag-related private message excerpts to category group moderators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59829",
"datePublished": "2026-08-17T15:26:53.835Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-08-17T19:00:49.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72732 (GCVE-0-2026-72732)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:18 – Updated: 2026-08-13 17:37
VLAI
EPSS
VEX
Title
Discourse: Templates endpoint exposes hidden tag names
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:37 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/25e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c9b… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f21… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f41… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T17:37:25.435786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:37:34.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:18:00.524Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm"
},
{
"name": "https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c"
},
{
"name": "https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b"
},
{
"name": "https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0"
},
{
"name": "https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1"
}
],
"source": {
"advisory": "GHSA-xrgc-52m8-82hm",
"discovery": "UNKNOWN"
},
"title": "Discourse: Templates endpoint exposes hidden tag names"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72732",
"datePublished": "2026-08-10T17:18:00.524Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-13T17:37:34.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}